CVE-2019-10927
published 2019-08-13CVE-2019-10927: A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200…
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
1.17%
67.2th percentile
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | scalance_xb-200_firmware | — | — |
| siemens | scalance_xc-200_firmware | — | — |
| siemens | scalance_xf-200ba_firmware | — | — |
| siemens | scalance_xp-200_firmware | — | — |
| siemens | scalance_xr-300wg_firmware | — | — |
| siemens_ag | scalance_sc-600 | — | — |
| siemens_ag | scalance_xb-200 | — | — |
| siemens_ag | scalance_xc-200 | — | — |
| siemens_ag | scalance_xf-200ba | — | — |
| siemens_ag | scalance_xp-200 | — | — |
| siemens_ag | scalance_xr-300wg | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
osv6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qwf6-8cjr-7638: A vulnerability has been identified in SCALANCE SC-600 (V2
ghsa_unreviewed·2022-05-24
CVE-2019-10927 [MEDIUM] GHSA-qwf6-8cjr-7638: A vulnerability has been identified in SCALANCE SC-600 (V2
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
OSV
CVE-2019-10927: A vulnerability has been identified in SCALANCE SC-600 (V2
osv·2019-08-13·CVSS 6.5
CVE-2019-10927 [MEDIUM] CVE-2019-10927: A vulnerability has been identified in SCALANCE SC-600 (V2
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
CISA ICS
Siemens SCALANCE Products (Update A)
cisa_ics·2019-08-15·CVSS 6.5
[MEDIUM] Siemens SCALANCE Products (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE Products (Update A)
Last RevisedJuly 14, 2020
Alert CodeICSA-19-227-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 6.6
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Siemens
- Equipment: SCALANCE Products
- Vulnerabilities: Improper Adherence to Coding Standards
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-227-03 Siemens SCALANCE Products that was published August 15, 2019, to the ICS webpage on us-cert.gov.
## 3. RISK EVALUATION
Successful exploitation of these vulnerabilities could
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-08-13
Published