Lucene search

SiemensCVE-2019-13926

HistoryFeb 11, 2020 - 4:15 p.m.

CVE-2019-13926

2020-02-1116:15:14

CWE-400

siemens

web.nvd.nist.gov

cve-2019-13926

scalance s602

scalance s612

scalance s623

scalance s627-2m

denial of service

nvd

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). Specially crafted packets sent to port 443/tcp of affected devices could cause a Denial-of-Service condition of the web server. A cold reboot is required to restore the functionality of the device.

Affected configurations

Nvd

Node

siemensscalance_s602Match-

AND

siemensscalance_s602_firmwareRange3.0–4.1

Node

siemensscalance_s612Match-

AND

siemensscalance_s612_firmwareRange3.0–4.1

Node

siemensscalance_s623Match-

AND

siemensscalance_s623_firmwareRange3.0–4.1

Node

siemensscalance_s627-2mMatch-

AND

siemensscalance_s627-2m_firmwareRange3.0–4.1

VendorProductVersionCPE
siemensscalance_s602-cpe:2.3:h:siemens:scalance_s602:-:*:*:*:*:*:*:*
siemensscalance_s602_firmware*cpe:2.3:o:siemens:scalance_s602_firmware:*:*:*:*:*:*:*:*
siemensscalance_s612-cpe:2.3:h:siemens:scalance_s612:-:*:*:*:*:*:*:*
siemensscalance_s612_firmware*cpe:2.3:o:siemens:scalance_s612_firmware:*:*:*:*:*:*:*:*
siemensscalance_s623-cpe:2.3:h:siemens:scalance_s623:-:*:*:*:*:*:*:*
siemensscalance_s623_firmware*cpe:2.3:o:siemens:scalance_s623_firmware:*:*:*:*:*:*:*:*
siemensscalance_s627-2m-cpe:2.3:h:siemens:scalance_s627-2m:-:*:*:*:*:*:*:*
siemensscalance_s627-2m_firmware*cpe:2.3:o:siemens:scalance_s627-2m_firmware:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	scalance_s602	-	cpe:2.3:h:siemens:scalance_s602:-:::::::*
siemens	scalance_s602_firmware	*	cpe:2.3:o:siemens:scalance_s602_firmware::::::::
siemens	scalance_s612	-	cpe:2.3:h:siemens:scalance_s612:-:::::::*
siemens	scalance_s612_firmware	*	cpe:2.3:o:siemens:scalance_s612_firmware::::::::
siemens	scalance_s623	-	cpe:2.3:h:siemens:scalance_s623:-:::::::*
siemens	scalance_s623_firmware	*	cpe:2.3:o:siemens:scalance_s623_firmware::::::::
siemens	scalance_s627-2m	-	cpe:2.3:h:siemens:scalance_s627-2m:-:::::::*
siemens	scalance_s627-2m_firmware	*	cpe:2.3:o:siemens:scalance_s627-2m_firmware::::::::

CNA Affected

[
  {
    "product": "SCALANCE S602",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  },
  {
    "product": "SCALANCE S612",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  },
  {
    "product": "SCALANCE S623",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  },
  {
    "product": "SCALANCE S627-2M",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions >= V3.0 and < V4.1"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-591405.pdf

www.us-cert.gov/ics/advisories/icsa-20-042-10

Social References

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

44.7%

JSON

Related for CVE-2019-13926