CVE-2019-13924
published 2020-02-11CVE-2019-13924: A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE…
PriorityP427medium5.4CVSS 3.1
AVNACLPRNUIRSUCLILAN
EPSS
0.83%
53.2th percentile
A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions < V4.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | scalance_s602 | — | — |
| siemens | scalance_s612 | — | — |
| siemens | scalance_s623 | — | — |
| siemens | scalance_s627-2m | — | — |
| siemens | scalance_x-200_switch_family | — | — |
| siemens | scalance_x-200irt_switch_family | — | — |
| siemens | scalance_x-200rna_switch_family | — | — |
| siemens | scalance_x-300_firmware | < 4.1.3 | 4.1.3 |
| siemens | scalance_x-300_switch_family | — | — |
| siemens | scalance_xb-200_firmware | < 5.2.4 | 5.2.4 |
| siemens | scalance_xc-200_firmware | < 5.2.4 | 5.2.4 |
| siemens | scalance_xf-200_firmware | < 5.2.4 | 5.2.4 |
| siemens | scalance_xp-200_firmware | < 5.2.4 | 5.2.4 |
| siemens | scalance_xr-300_firmware | < 4.1.3 | 4.1.3 |
| siemens | scalance_xr-300wg_firmware | < 4.1.3 | 4.1.3 |
CVSS provenance
nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SCALANCE X Switches (Update C)
cisa_ics·2021-04-13·CVSS 5.4
[MEDIUM] Siemens SCALANCE X Switches (Update C)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SCALANCE X Switches (Update C)
Last RevisedDecember 15, 2022
Alert CodeICSA-20-042-07
## 1. EXECUTIVE SUMMARY
- CVSS v3 4.2
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: Siemens
- Equipment: SCALANCE X switches
- Vulnerability: Protection Mechanism Failure
## 2. UPDATE INFORMATION
This updated advisory is a follow-up to the advisory update titled ICSA-20-042-07 Siemens SCALANCE X Switches (Update B) that was published April 13, 2021, to the ICS webpage on us-cert.cisa.gov.
## 3. RISK EVALUATION
Successful exploitation of this vulnerabilit
GHSA
GHSA-9v8p-c94c-q287: A vulnerability has been identified in SCALANCE X-200 switch family (incl
ghsa_unreviewed·2022-05-24
CVE-2019-13924 [MEDIUM] CWE-1021 GHSA-9v8p-c94c-q287: A vulnerability has been identified in SCALANCE X-200 switch family (incl
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (all versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (all versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface. At the time of advisory publication no public exploitation of this securi
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-02-11
Published