Siemens SCALANCE X Switches (Update B)
Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-13924US | medium5.4 | — | ||
A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions… | ||||
references
External citations — patches, advisories, analysis.
- SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families - CSAF Versionself
- SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families - PDF Versionself
- SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families - TXT Versionself
- ICS Advisory ICSA-20-042-07 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-20-042-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (16)
- MitigationSCALANCE S602
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE S612
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE S623
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE S627-2M
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-200RNA switch family
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- FixedSCALANCE S602
Update to V4.1 or later version Update is only available via Siemens Support contact
- FixedSCALANCE S612
Update to V4.1 or later version Update is only available via Siemens Support contact
- FixedSCALANCE S623
Update to V4.1 or later version Update is only available via Siemens Support contact
- FixedSCALANCE S627-2M
Update to V4.1 or later version Update is only available via Siemens Support contact
- FixedSCALANCE X-200 switch family (incl. SIPLUS NET variants)
Update to V5.2.4 or later version
https://support.industry.siemens.com/cs/document/109767965/ - FixedSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
Update to V5.5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109792534/ - FixedSCALANCE X-200RNA switch family
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/ - FixedSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Update to V4.1.3 or later version
https://support.industry.siemens.com/cs/document/109773547/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan