CVE-2019-13924

mediumpriority · track · 22EPSS 0.008 · 57 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.83% (57th) EPSS
CVSS 4.3 · medium
Is it mine?
40 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · siemens_psirt

EPSS · scored 2026-10-27

A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions < V4.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSCALANCE S602siemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE S612siemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE S623siemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE S627-2Msiemens_psirt

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE X-200 switch family (incl. SIPLUS NET variants)siemens_psirt

    Update to V5.2.4 or later version

    https://support.industry.siemens.com/cs/document/109767965/
  • FixedSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)siemens_psirt

    Update to V5.5.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109792534/
  • FixedSCALANCE X-200RNA switch familysiemens_psirt

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • FixedSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)siemens_psirt

    Update to V4.1.3 or later version

    https://support.industry.siemens.com/cs/document/109773547/
  • FixedSCALANCE S602cisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE S612cisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE S623cisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE S627-2Mcisa_csaf_ot

    Update to V4.1 or later version Update is only available via Siemens Support contact

  • FixedSCALANCE X-200 switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Update to V5.2.4 or later version

    https://support.industry.siemens.com/cs/document/109767965/
  • FixedSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Update to V5.5.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109792534/
  • FixedSCALANCE X-200RNA switch familycisa_csaf_ot

    Update to V3.2.7 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814809/
  • FixedSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)cisa_csaf_ot

    Update to V4.1.3 or later version

    https://support.industry.siemens.com/cs/document/109773547/
  • MitigationSCALANCE S602siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S612siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S623siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S627-2Msiemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200RNA switch familysiemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)siemens_psirt

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S602cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S612cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S623cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE S627-2Mcisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200 switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200IRT switch family (incl. SIPLUS NET variants)cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-200RNA switch familycisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

  • MitigationSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)cisa_csaf_ot

    Only access links from trusted sources in the browser you use to configure the SCALANCE X switches.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.4
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v3.15.4mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.5
v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:U/RC:Csecondary · CISA US
v3.14.2mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L/E:P/RL:U/RC:Csecondary · Siemens ProductCERT DE
v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1021USCWE-693USCWE-693USCWE-693US
04

affected products (40)

Products and version ranges known to be affected.

showing 20 of 40
05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SSA-951513SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families2020-02-11csaf · siemens_psirtDE

    Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-20-042-07Siemens SCALANCE X Switches (Update B)2020-02-11icsa · cisa_csaf_otUS

    Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions if the victim is tricked into clicking on a website controlled by the attacker. The attack only works if the victim has an authenticated session on the administrative interface of the switch. Siemens has released updates for the affected products and recommends to update to the latest versions.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otsiemens_psirtNVDCVE.orgMITRE
published 2020-02-11modified 2026-06-17
08

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan