Medium severity · published Aug 13, 2019
CVE-2019-10928
A vulnerability has been identified in SCALANCE SC-600 (V2.0)
6.6
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Scalance Sc-600 Firmware · Siemens
2.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10928
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10928
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf
More from Scalance Sc-600 Firmware
9.1
CVE-2022-36323
Affected devices do not properly sanitize an input field
7.5
CVE-2021-25676
A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE SC-600 (All Versions >= V2.1 and < V2.1.3)
7.5
CVE-2018-5391
The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly
5.9
CVE-2021-3449
NULL pointer deref in signature_algorithms processing
4.8
CVE-2022-36325
Affected devices do not properly sanitize data introduced by an user when rendering the web interface