« Volver al listado

CVE-2019-6585

Estado: ModificadaMedia (6.1)—

A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Siemens — Scalance S602 FirmwareSiemens — Scalance S612 FirmwareSiemens — Scalance S623 FirmwareSiemens — Scalance S627-2m Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-6585",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "productcert@siemens.com",
      "affectedData": [
        {
          "vendor": "Siemens",
          "product": "SCALANCE S602",
          "versions": [
            {
              "status": "affected",
              "version": "All versions >= V3.0 and < V4.1"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SCALANCE S612",
          "versions": [
            {
              "status": "affected",
              "version": "All versions >= V3.0 and < V4.1"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SCALANCE S623",
          "versions": [
            {
              "status": "affected",
              "version": "All versions >= V3.0 and < V4.1"
            }
          ]
        },
        {
          "vendor": "Siemens",
          "product": "SCALANCE S627-2M",
          "versions": [
            {
              "status": "affected",
              "version": "All versions >= V3.0 and < V4.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-03-10T20:15:20.257",
  "references": [
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-591405.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-042-10",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "productcert@siemens.com"
    },
    {
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-591405.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsa-20-042-10",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "productcert@siemens.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en SCALANCE S602 (Todas las versiones posteriores o iguales a V3.0 y anteriores a V4.1), SCALANCE S612 (Todas las versiones posteriores o iguales a V3.0 y anteriores a V4.1), SCALANCE S623 (Todas las versiones posteriores o iguales a V3.0 y anteriores a V4.1), SCALANCE S627-2M (Todas las versiones posteriores o iguales a V3.0 y anteriores a V4.1). El servidor web de configuración integrado de los dispositivos afectados podría permitir ataques de Cross-Site Scripting (XSS) si los usuarios desprevenidos son engañados para acceder a un enlace malicioso. Se requiere la interacción del usuario para una explotación exitosa. El usuario debe estar conectado a la interfaz web para que la explotación tenga éxito"
    }
  ],
  "lastModified": "2026-06-17T02:39:18.920",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:scalance_s602_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253D14CB-CD7E-40B0-8F3F-1D35FDC46658",
              "versionEndExcluding": "4.1",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:scalance_s602:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F4D89D82-C2CE-44DC-A05B-B956F20BF4E3"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:scalance_s612_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "340031C6-BD77-4601-AA35-4B3A85729576",
              "versionEndExcluding": "4.1",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:scalance_s612:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "CA7B48D2-0D17-420D-AAE1-35E5C0BE2924"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:scalance_s623_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E518E7C-EDF2-4E6A-8C9F-7623FC66CC3F",
              "versionEndExcluding": "4.1",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:scalance_s623:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F80D9A79-7984-462B-B4B9-6A4429422038"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:siemens:scalance_s627-2m_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FA5FF74-3117-48F0-8AE6-658B180B7FF0",
              "versionEndExcluding": "4.1",
              "versionStartIncluding": "3.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:siemens:scalance_s627-2m:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B51B40F8-71D2-4D2D-8EC2-CE154A6D7533"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com"
}