Siemens SCALANCE X-200RNA/SCALANCE X-300 Web Configuration Interface GET Request missing authentication

Summaryinfo

A vulnerability has been found in Siemens SCALANCE X-200RNA and SCALANCE X-300 and classified as critical. This vulnerability affects unknown code of the component Web Configuration Interface. The manipulation as part of GET Request leads to missing authentication. This vulnerability is referenced as CVE-2019-13933. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Siemens SCALANCE X-200RNA and SCALANCE X-300 (the affected version unknown). It has been rated as critical. This issue affects an unknown part of the component Web Configuration Interface. The manipulation as part of a GET Request leads to a missing authentication vulnerability. Using CWE to declare the problem leads to CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). Affected devices contain a vulnerability that allows an unauthenticated attacker to violate access-control rules. The vulnerability can be triggered by sending GET request to specific uniform resource locator on the web configuration interface of the device. The security vulnerability could be exploited by an attacker with network access to the affected systems. An attacker could use the vulnerability to obtain sensitive information or change the device configuration. At the time of advisory publication no public exploitation of this security vulnerability was known.

The weakness was published 01/16/2020. The identification of this vulnerability is CVE-2019-13933 since 07/18/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Siemens

Name

• SCALANCE X-200RNA
• SCALANCE X-300

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion