Lucene search

[email protected]CVE-2019-13924

HistoryFeb 11, 2020 - 4:15 p.m.

CVE-2019-13924

2020-02-1116:15:14

CWE-693

CWE-1021

[email protected]

web.nvd.nist.gov

cve-2019-13924

scalance s602

scalance s612

scalance s623

scalance s627-2m

scalance x-200

scalance x-200irt

scalance x-200rna

scalance x-300

clickjacking

administrative actions

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.3%

JSON

A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions < V4.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface.

Affected configurations

NVD

Node

siemensscalance_xc-200Match-

AND

siemensscalance_xc-200_firmwareRange<5.2.4

Node

siemensscalance_xf-200Match-

AND

siemensscalance_xf-200_firmwareRange<5.2.4

Node

siemensscalance_xp-200Match-

AND

siemensscalance_xp-200_firmwareRange<5.2.4

Node

siemensscalance_x-200irtMatch-

AND

siemensscalance_x-200irt_firmware

Node

siemensscalance_xb-200Match-

AND

siemensscalance_xb-200_firmwareRange<5.2.4

Node

siemensscalance_xr-300wgMatch-

AND

siemensscalance_xr-300wg_firmwareRange<4.1.3

Node

siemensscalance_x-300Match-

AND

siemensscalance_x-300_firmwareRange<4.1.3

Node

siemensscalance_xr-300Match-

AND

siemensscalance_xr-300_firmwareRange<4.1.3

CPENameOperatorVersion
siemens:scalance_xc-200_firmwaresiemens scalance xc-200 firmwarelt5.2.4

CPE	Name	Operator	Version
siemens:scalance_xc-200_firmware	siemens scalance xc-200 firmware	lt	5.2.4

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "SCALANCE S602",
    "versions": [
      {
        "version": "All versions < V4.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE S612",
    "versions": [
      {
        "version": "All versions < V4.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE S623",
    "versions": [
      {
        "version": "All versions < V4.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE S627-2M",
    "versions": [
      {
        "version": "All versions < V4.1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE X-200 switch family (incl. SIPLUS NET variants)",
    "versions": [
      {
        "version": "All versions < 5.2.4",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)",
    "versions": [
      {
        "version": "All versions < V5.5.0",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE X-200RNA switch family",
    "versions": [
      {
        "version": "All versions < V3.2.7",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Siemens",
    "product": "SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)",
    "versions": [
      {
        "version": "All versions < 4.1.3",
        "status": "affected"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-951513.pdf

www.us-cert.gov/ics/advisories/icsa-20-042-07

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

36.3%

JSON

Related for CVE-2019-13924

nessus1 cvelist1 nvd1 ics1 prion1