Unscored severity · published Oct 3, 2013
CVE-2013-5944
The integrated web server on Siemens SCALANCE X-200 switches with firmware before 4.5.0 and X-200IRT switches with firmware before 5.1.0 does not properly enforce authentication…
–
CVSS
3.2%
EPSS
No
On KEV
Description
The integrated web server on Siemens SCALANCE X-200 switches with firmware before 4.5.0 and X-200IRT switches with firmware before 5.1.0 does not properly enforce authentication requirements, which allows remote attackers to perform administrative actions via requests to the management interface.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SX
Scalance X-200 · Siemens
All versions, or not specified · source: NVD
SX
Scalance X-200 Series Firmware · Siemens
through 4.4; 4.3; through 5.0.1 · source: NVD
SX
Scalance X-200irt · Siemens
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-5944
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-5944
Vendor Advisory
http://www.siemens.com/innovation/pool/de/forschungsfelder/siemens_security_advisory_ssa-176087.pdf
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/pdf/ssa-176087.pdf
More from Scalance X-200
–
CVE-2013-5709
The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values…