CVE-2019-13933

Опубликовано: 16 янв. 2020

Источник: nvd

CVSS3: 8.6

CVSS2: 7.5

EPSS Низкий

Описание

A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA EEC (PRP/HSR), SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M

Ссылки

https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf
Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-014-03
Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf
Vendor Advisory
https://www.us-cert.gov/ics/advisories/icsa-20-014-03
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:siemens:scalance_x-200rna_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:scalance_x-200rna:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:siemens:scalance_x204rna_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:o:siemens:scalance_x-300_firmware:*:*:*:*:*:*:*:*

Версия до 4.1.3 (исключая)

cpe:2.3:h:siemens:scalance_x-300:-:*:*:*:*:*:*:*

Конфигурация 4

Одновременно

cpe:2.3:o:siemens:scalance_xr-300wg_firmware:*:*:*:*:*:*:*:*

Версия до 4.1.3 (исключая)

cpe:2.3:h:siemens:scalance_xr-300wg:-:*:*:*:*:*:*:*

Конфигурация 5

Одновременно

cpe:2.3:o:siemens:scalance_xr-300_firmware:*:*:*:*:*:*:*:*

Версия до 4.1.3 (исключая)

cpe:2.3:h:siemens:scalance_xr-300:-:*:*:*:*:*:*:*

Конфигурация 6

Одновременно

cpe:2.3:o:siemens:scalance_x408-2_firmware:*:*:*:*:*:*:*:*

Версия до 4.1.3 (исключая)

cpe:2.3:h:siemens:scalance_x408-2:-:*:*:*:*:*:*:*

Конфигурация 7

Одновременно

cpe:2.3:o:siemens:siplus_net_csm_1277_firmware:*:*:*:*:*:*:*:*

Версия до 4.1.3 (исключая)

cpe:2.3:h:siemens:siplus_net_csm_1277:-:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.00711

Низкий

8.6 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-306

Связанные уязвимости

GHSA-5vx5-pc42-77fx

CVSS3: 8.6

github

больше 3 лет назад

A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). Affected devices contain a vulnerability that allows an unauthenticated attacker to violate access-control rules. The vulnerability can be triggered by sending GET request to specific uniform resource locator on the web configuration interface of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. An attacker could use the vulnerability to obtain sensitive information or change the device configuration. At the time of advisory publication no public exploitation of this security vulnerability was known.

BDU:2020-01386

CVSS3: 8.6

fstec

около 6 лет назад

Уязвимость веб-интерфейса промышленных коммутаторов Siemens SCALANCE X, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

EPSS

Процентиль: 72%

0.00711

Низкий

8.6 High

CVSS3

7.5 High

CVSS2

Дефекты

CWE-306