A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-591405.pdf | Vendor Advisory |
| https://www.us-cert.gov/ics/advisories/icsa-20-042-10 | Third Party Advisory US Government Resource |
Configurations
Configuration 1 (hide)
| AND |
|
Configuration 2 (hide)
| AND |
|
Configuration 3 (hide)
| AND |
|
Configuration 4 (hide)
| AND |
|
History
25 Apr 2023, 18:25
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.us-cert.gov/ics/advisories/icsa-20-042-10 - Third Party Advisory, US Government Resource |
Information
Published : 2020-03-10 20:15
Updated : 2024-02-04 20:39
NVD link : CVE-2019-6585
Mitre link : CVE-2019-6585
CVE.ORG link : CVE-2019-6585
JSON object : View
Products Affected
siemens
- scalance_s627-2m_firmware
- scalance_s612
- scalance_s602
- scalance_s623_firmware
- scalance_s602_firmware
- scalance_s627-2m
- scalance_s623
- scalance_s612_firmware