CVE-2019-6567

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords.

Se ha identificado una vulnerabilidad en la familia de switches SCALANCE X-200 (incluidas las variantes SIPLUS NET) (Todas las versiones anteriores a V5.2.4), familia de switches SCALANCE X-200IRT (incluidas las variantes SIPLUS NET) (Todas las versiones anteriores a V5.5.0), familia de switches SCALANCE X-300 (incluyendo X408 y las variantes SIPLUS NET) (Todas las versiones anteriores a V4.1.3), SCALANCE X-414-3E (Todas las versiones). Los dispositivos afectados almacenan contraseñas en un formato recuperable. Un atacante puede extraer y recuperar contraseñas de dispositivos desde la configuración del dispositivo. La explotación exitosa requiere acceso a una copia de seguridad de la configuración del dispositivo e impacta la confidencialidad de las contraseñas almacenadas. En el momento de la publicación del aviso no se conocía la explotación pública de esta vulnerabilidad de seguridad

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-01-22 CVE Reserved
2019-06-12 CVE Published
2023-03-08 EPSS Updated
2024-08-04 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-257: Storing Passwords in a Recoverable Format
CWE-522: Insufficiently Protected Credentials

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://cert-portal.siemens.com/productcert/pdf/ssa-646841.pdf	2021-02-09

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Siemens Search vendor "Siemens"	Scalance X-200 Firmware Search vendor "Siemens" for product "Scalance X-200 Firmware"	< 5.2.4 Search vendor "Siemens" for product "Scalance X-200 Firmware" and version " < 5.2.4"	-	Affected	in	Siemens Search vendor "Siemens"	Scalance X-200 Search vendor "Siemens" for product "Scalance X-200"	-	-	Safe
Siemens Search vendor "Siemens"	Scalance X-200irt Firmware Search vendor "Siemens" for product "Scalance X-200irt Firmware"	*	-	Affected	in	Siemens Search vendor "Siemens"	Scalance X-200irt Search vendor "Siemens" for product "Scalance X-200irt"	-	-	Safe
Siemens Search vendor "Siemens"	Scalance X-300 Firmware Search vendor "Siemens" for product "Scalance X-300 Firmware"	*	-	Affected	in	Siemens Search vendor "Siemens"	Scalance X-300 Search vendor "Siemens" for product "Scalance X-300"	-	-	Safe
Siemens Search vendor "Siemens"	Scalance X-414-3e Firmware Search vendor "Siemens" for product "Scalance X-414-3e Firmware"	*	-	Affected	in	Siemens Search vendor "Siemens"	Scalance X-414-3e Search vendor "Siemens" for product "Scalance X-414-3e"	-	-	Safe