CVE-2018-4842
lowPriorität · verfolgen · 19EPSS 0.008 · 57. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). A remote, authenticated attacker with access to the configuration web server could be able to store script code on the web site, if the HRP redundancy option is set. This code could be executed in the web browser of victims visiting this web site (XSS), affecting its confidentiality, integrity and availability. User interaction is required for successful exploitation, as the user needs to visit the manipulated web site. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)siemens_psirt
Update to V5.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109758144/ - BehobenSCALANCE X-200RNA switch familysiemens_psirt
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/ - BehobenSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)siemens_psirt
Update to V4.1.3 or later version
https://support.industry.siemens.com/cs/document/109773547/ - BehobenSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)cisa_csaf_ot
Update to V5.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109758144/ - BehobenSCALANCE X-200RNA switch familycisa_csaf_ot
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/ - BehobenSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)cisa_csaf_ot
Update to V4.1.3 or later version
https://support.industry.siemens.com/cs/document/109773547/ - MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)siemens_psirt
To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.
- MitigationSCALANCE X-200RNA switch familysiemens_psirt
To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.
- MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)siemens_psirt
To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.
- MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)cisa_csaf_ot
To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.
- MitigationSCALANCE X-200RNA switch familycisa_csaf_ot
To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.
- MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)cisa_csaf_ot
To exploit CVE-2018-4842, the attacker needs to be able to log into the administrative web application.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 3.5–5.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (18)
Betroffene Produkte und Versionsbereiche.
- Siemens SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)All versions → V5.4.1enisa_euvdEU
- siemens scalance x200irt firmware< 5.4.1nvdUScpe:2.3:o:siemens:scalance_x200irt_firmware:*:*:*:*:*:*:*:*
- siemens scalance x300 firmwarealle VersionennvdUScpe:2.3:o:siemens:scalance_x300_firmware:*:*:*:*:*:*:*:*
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-480829SSA-480829: Cross-Site Scripting Vulnerabilities in SCALANCE X Switches2018-06-12csaf · siemens_psirtDE
Two cross-site scripting (XSS) vulnerabilities were identified in the web server of several SCALANCE X switches. Siemens has released updates for the affected products and recommends to update to the latest versions.
- ICSA-18-163-02Siemens SCALANCE X Switches (Update A)2018-06-12icsa · cisa_csaf_otUS
Two cross-site scripting (XSS) vulnerabilities were identified in the web server of several SCALANCE X switches. Siemens has released updates for the affected products and recommends to update to the latest versions.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (8)
Externe Belege — Patches, Meldungen, Analysen.
- https://cert-portal.siemens.com/productcert/pdf/ssa-480829.pdfcnnvd
- https://cert-portal.siemens.com/productcert/txt/ssa-480829.txtPatchcnnvd
- https://www.securityfocus.com/bid/104494cnnvd
- https://www.us-cert.gov/ics/advisories/ICSA-18-163-02cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-480829.pdfenisa_euvd
- https://www.securityfocus.com/bid/104494enisa_euvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-480829.pdfMitigationVendor Advisorynvd
- https://www.securityfocus.com/bid/104494nvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan