SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families
Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-13924US | medium5.4 | — | ||
A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families - CSAF Versionself
- SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families - PDF Versionself
- SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families - TXT Versionself
Behebungen (16)
- MitigationSCALANCE S602
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE S612
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE S623
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE S627-2M
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-200RNA switch family
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.
- BehobenSCALANCE S602
Update to V4.1 or later version Update is only available via Siemens Support contact
- BehobenSCALANCE S612
Update to V4.1 or later version Update is only available via Siemens Support contact
- BehobenSCALANCE S623
Update to V4.1 or later version Update is only available via Siemens Support contact
- BehobenSCALANCE S627-2M
Update to V4.1 or later version Update is only available via Siemens Support contact
- BehobenSCALANCE X-200 switch family (incl. SIPLUS NET variants)
Update to V5.2.4 or later version
https://support.industry.siemens.com/cs/document/109767965/ - BehobenSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
Update to V5.5.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109792534/ - BehobenSCALANCE X-200RNA switch family
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/ - BehobenSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Update to V4.1.3 or later version
https://support.industry.siemens.com/cs/document/109773547/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan