CVE-2019-13924

mediumPriorität · verfolgen · 22EPSS 0.008 · 57. PerzentilDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.83% (57th) EPSS
CVSS 4.3 · medium
Is it mine?
40 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · bewertet 2026-10-27

A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions < V4.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenSCALANCE S602siemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE S612siemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE S623siemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE S627-2Msiemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE X-200 switch family (incl. SIPLUS NET variants)siemens_psirt

    Update to V5.2.4 or later version

    https://support.industry.siemens.com/cs/document/109767965/
  • BehobenSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)siemens_psirt

    Update to V5.5.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109792534/
  • BehobenSCALANCE X-200RNA switch familysiemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)siemens_psirt

    Update to V4.1.3 or later version

    https://support.industry.siemens.com/cs/document/109773547/
  • BehobenSCALANCE S602cisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE S612cisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE S623cisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE S627-2Mcisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • BehobenSCALANCE X-200 switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Update to V5.2.4 or later version

    https://support.industry.siemens.com/cs/document/109767965/
  • BehobenSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Update to V5.5.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109792534/
  • BehobenSCALANCE X-200RNA switch familycisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • BehobenSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)cisa_csaf_ot

    Update to V4.1.3 or later version

    https://support.industry.siemens.com/cs/document/109773547/
  • MitigationSCALANCE S602siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S612siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S623siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S627-2Msiemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200RNA switch familysiemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S602cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S612cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S623cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S627-2Mcisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200RNA switch familycisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.4
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9
v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 2.5
v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:U/RC:Csecondary · CISA US
v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:U/RC:Csecondary · Siemens ProductCERT DE
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-1021USCWE-693USCWE-693USCWE-693US
04

betroffene Produkte (40)

Betroffene Produkte und Versionsbereiche.

20 von 40 angezeigt
05

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

  • SSA-951513SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families2020-02-11csaf · siemens_psirtDE

    Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-20-042-07Siemens SCALANCE X Switches (Update B)2020-02-11icsa · cisa_csaf_otUS

    Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has released updates for the affected products and recommends to update to the latest versions.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
veröffentlicht 2020-02-11geändert 2026-06-17
08

Referenzen (20)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan