SSA-480829

csafDEsiemens_psirt

SSA-480829: Cross-Site Scripting Vulnerabilities in SCALANCE X Switches

view advisory published 2018-06-12

Two cross-site scripting (XSS) vulnerabilities were identified in the web server of several SCALANCE X switches. Siemens has released updates for the affected products and recommends to update to the latest versions.

01

describes (2)

Related CVEs.

IDseverity exploitable
CVE-2018-4848USmedium6.1—
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)…
CVE-2018-4842USmedium4.8—
A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7),…
02

references

External citations — patches, advisories, analysis.

03

remediations (14)

  • MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • MitigationSCALANCE X-200RNA switch family

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • MitigationSCALANCE X-200RNA switch family

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)

    To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.

  • FixedSCALANCE X-200 switch family (incl. SIPLUS NET variants)

    Update to V5.2.3 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109758142/
  • FixedSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)

    Update to V5.4.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109758144/
  • FixedSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)

    Update to V5.4.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109758144/
  • FixedSCALANCE X-200RNA switch family

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • FixedSCALANCE X-200RNA switch family

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • FixedSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)

    Update to V4.1.3 or later version

    https://support.industry.siemens.com/cs/document/109773547/
  • FixedSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)

    Update to V4.1.3 or later version

    https://support.industry.siemens.com/cs/document/109773547/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan