Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2013-3633

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.

Published

2013-05-24T20:55:01.737

Last Modified

2025-04-11T00:51:21.963

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 8.0 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:C

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: COMPLETE
Exploitability Score

8.0

Impact Score

8.5

Weaknesses
  • Type: Primary
    CWE-264
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System siemens scalance_x200irt_firmware ≤ 5.0.0 Yes
Hardware siemens scalance_x200-4p_irt - Yes
Hardware siemens scalance_x201-3p_irt - Yes
Hardware siemens scalance_x201-3p_irt - Yes
Hardware siemens scalance_x202-2irt - Yes
Hardware siemens scalance_x202-2p_irt - Yes
Hardware siemens scalance_x202-2p_irt - Yes
Hardware siemens scalance_x204irt - Yes
Hardware siemens scalance_x204irt - Yes
Hardware siemens scalance_xf204irt - Yes
References