Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-6567

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords.

Published

2019-06-12T14:29:04.820

Last Modified

2024-11-21T04:46:42.633

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.5 (MEDIUM)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

3.9

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-257
  • Type: Primary
    CWE-522
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System siemens scalance_x-200_firmware < 5.2.4 Yes
Hardware siemens scalance_x-200 - No
Operating System siemens scalance_x-200irt_firmware * Yes
Hardware siemens scalance_x-200irt - No
Operating System siemens scalance_x-300_firmware * Yes
Hardware siemens scalance_x-300 - No
Operating System siemens scalance_x-414-3e_firmware * Yes
Hardware siemens scalance_x-414-3e - No
References