Medium severity · published Aug 13, 2019
CVE-2019-10927
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG…
6.5
CVSS
1.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SX
Scalance Xb-200 Firmware · Siemens
4.1 · source: NVD
SX
Scalance Xc-200 Firmware · Siemens
4.1 · source: NVD
SX
Scalance Xf-200ba Firmware · Siemens
4.1 · source: NVD
SX
Scalance Xp-200 Firmware · Siemens
4.1 · source: NVD
SX
Scalance Xr-300wg Firmware · Siemens
4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10927
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10927
Patch
https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf
More from Scalance Xb-200 Firmware
9.1
CVE-2022-36323
Affected devices do not properly sanitize an input field
8.8
CVE-2021-25667
A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3…
8.8
CVE-2017-12736
After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions
7.5
CVE-2022-36324
Affected devices do not properly handle the renegotiation of SSL/TLS parameters
7.5
CVE-2020-28400
Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition