CVE-2018-13807
highPriorität · verfolgen · 35EPSS 0.042 · 91. PerzentilEURUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versions). The web interface on port 443/tcp could allow an attacker to cause a Denial-of-Service condition by sending specially crafted packets to the web server. The device will automatically reboot, impacting network availability for other devices. An attacker must have network access to port 443/tcp to exploit the vulnerability. Neither valid credentials nor interaction by a legitimate user is required to exploit the vulnerability. There is no confidentiality or integrity impact, only availability is temporarily impacted. This vulnerability could be triggered by publicly available tools.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSCALANCE X-300 switch family (incl. SIPLUS NET variants)cisa_csaf_ot
Update to V4.1.2 https://support.industry.siemens.com/cs/us/en/view/109753720
- BehobenSCALANCE X408cisa_csaf_ot
Update to V4.1.2 https://support.industry.siemens.com/cs/us/en/view/109753720
- MitigationSCALANCE X-300 switch family (incl. SIPLUS NET variants)cisa_csaf_ot
Protect network access to the integrated web server on port 443/tcp with appropriate mechanisms: Restrict network access to port 443/tcp to trusted IP addresses, and avoid running vulnerability scanning tools from trusted IP addresses on affected devices.
- MitigationSCALANCE X408cisa_csaf_ot
Protect network access to the integrated web server on port 443/tcp with appropriate mechanisms: Restrict network access to port 443/tcp to trusted IP addresses, and avoid running vulnerability scanning tools from trusted IP addresses on affected devices.
- MitigationSCALANCE X414cisa_csaf_ot
Protect network access to the integrated web server on port 443/tcp with appropriate mechanisms: Restrict network access to port 443/tcp to trusted IP addresses, and avoid running vulnerability scanning tools from trusted IP addresses on affected devices.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (15)
Betroffene Produkte und Versionsbereiche.
- Siemens AG SCALANCE X300, SCALANCE X408, SCALANCE X414SCALANCE X300 : All versions → V4.0.0enisa_euvdEU
- Siemens AG SCALANCE X300, SCALANCE X408, SCALANCE X414SCALANCE X408 : All versions → V4.0.0enisa_euvdEU
- siemens scalance x414 firmwarealle VersionennvdUScpe:2.3:o:siemens:scalance_x414_firmware:*:*:*:*:*:*:*:*
Advisories (1)
Hersteller- und Ökosystem-Meldungen dazu.
- ICSA-18-254-05Siemens SCALANCE X Switches2018-09-11icsa · cisa_csaf_otUS
As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (9)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-447396.pdfcnnvd
- https://ics-cert.us-cert.gov/advisories/ICSA-18-254-05cnnvd
- https://www.securityfocus.com/bid/105331cnnvd
- http://www.securityfocus.com/bid/105331enisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-447396.pdfenisa_euvd
- https://ics-cert.us-cert.gov/advisories/ICSA-18-254-05enisa_euvd
- http://www.securityfocus.com/bid/105331Third Party AdvisoryVDB Entrynvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-447396.pdfVendor Advisorynvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan