CVE-2019-6585

mediumpriority · track · 24EPSS 0.007 · 54 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.74% (54th) EPSS
CVSS 4.3 · medium
Is it mine?
20 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · scored 2026-10-27

A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedSCALANCE S602siemens_psirt

    Update to V4.1

  • FixedSCALANCE S612siemens_psirt

    Update to V4.1

  • FixedSCALANCE S623siemens_psirt

    Update to V4.1

  • FixedSCALANCE S627-2Msiemens_psirt

    Update to V4.1

  • FixedSCALANCE S602cisa_csaf_ot

    Update to V4.1

  • FixedSCALANCE S612cisa_csaf_ot

    Update to V4.1

  • FixedSCALANCE S623cisa_csaf_ot

    Update to V4.1

  • FixedSCALANCE S627-2Mcisa_csaf_ot

    Update to V4.1

  • MitigationSCALANCE S602siemens_psirt

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S612siemens_psirt

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S623siemens_psirt

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S627-2Msiemens_psirt

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S602cisa_csaf_ot

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S612cisa_csaf_ot

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S623cisa_csaf_ot

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

  • MitigationSCALANCE S627-2Mcisa_csaf_ot

    Only access links from trusted sources in the browser you use to access the SCALANCE S-600 administration website.

02

cvss

Technical severity, 0–10. One row per scoring source.

6.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:N/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7
v3.14.7mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · CISA US
v3.14.7mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-80USCWE-80USCWE-80US
04

affected products (20)

Products and version ranges known to be affected.

05

advisories (2)

Vendor and ecosystem advisories describing this.

  • SSA-591405SSA-591405: Web Vulnerabilities in SCALANCE S-600 Family2020-02-11csaf · siemens_psirtDE

    The firmware for SCALANCE S-600 family devices contains multiple web vulnerabilities. The vulnerabilities could allow an remote attacker to conduct Denial-of-Service attacks or perform Cross-Site Scripting attacks. Siemens has released updates for the affected products and recommends to update to the latest versions, or to upgrade to a successor product.

  • ICSA-20-042-10Siemens SCALANCE S-600 (Update B)2020-02-11icsa · cisa_csaf_otUS

    The firmware for SCALANCE S-600 family devices contains multiple web vulnerabilities. The vulnerabilities could allow an remote attacker to conduct Denial-of-Service attacks or perform Cross-Site Scripting attacks. Siemens has released updates for the affected products and recommends to update to the latest versions, or to upgrade to a successor product.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otnvdsiemens_psirtNVDCVE.orgMITRE
published 2020-03-10modified 2026-06-17
08

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan