CVE-2019-10928
published 2019-08-13CVE-2019-10928: A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected…
PriorityP432medium6.6CVSS 3.1
AVPACLPRLUINSUCHIHAH
EPSS
0.41%
33.0th percentile
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | scalance_sc-600_firmware | — | — |
| siemens_ag | scalance_sc-600 | — | — |
CVSS provenance
nvdv3.16.6MEDIUMCVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-m34p-92f7-v94j: A vulnerability has been identified in SCALANCE SC-600 (V2
ghsa_unreviewed·2022-05-24
CVE-2019-10928 [MEDIUM] GHSA-m34p-92f7-v94j: A vulnerability has been identified in SCALANCE SC-600 (V2
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.
CISA ICS
Siemens SCALANCE Products (Update A)
cisa_ics·2019-08-15·CVSS 6.5
[MEDIUM] Siemens SCALANCE Products (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE Products (Update A)
Last RevisedJuly 14, 2020
Alert CodeICSA-19-227-03
## 1. EXECUTIVE SUMMARY
- CVSS v3 6.6
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Siemens
- Equipment: SCALANCE Products
- Vulnerabilities: Improper Adherence to Coding Standards
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the original advisory titled ICSA-19-227-03 Siemens SCALANCE Products that was published August 15, 2019, to the ICS webpage on us-cert.gov.
## 3. RISK EVALUATION
Successful exploitation of these vulnerabilities could
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-08-13
Published