CVE-2019-6585

2020-03-1019:16:17

CWE-80

siemens

www.cve.org

0.001 Low

EPSS

Percentile

46.5%

JSON

A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.

CNA Affected

[
  {
    "product": "SCALANCE S602",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  },
  {
    "product": "SCALANCE S612",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  },
  {
    "product": "SCALANCE S623",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  },
  {
    "product": "SCALANCE S627-2M",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  }
]