CVE-2019-10928

A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.

CVSS v3 6.6 MEDIUM
CVSS v2.0 4.6 MEDIUM

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:siemens:scalance_sc-600_firmware:2.0:*:*:*:*:*:*:*

cpe:2.3:h:siemens:scalance_sc-600:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-08-13 19:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-10928

Mitre link : CVE-2019-10928

CVE.ORG link : CVE-2019-10928

JSON object : View

Products Affected

siemens

scalance_sc-600
scalance_sc-600_firmware

CWE

NVD-CWE-Other CWE-703

Improper Check or Handling of Exceptional Conditions

{"id": "CVE-2019-10928", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}]}, "published": "2019-08-13T19:15:14.767", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-703"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en SCALANCE SC-600 (V2.0). Un atacante autenticado con acceso al puerto 22 / tcp, as\u00ed como acceso f\u00edsico a un dispositivo afectado, puede activar el dispositivo para permitir la ejecuci\u00f3n de comandos arbitrarios. La vulnerabilidad de seguridad podr\u00eda ser explotada por un atacante autenticado con acceso f\u00edsico al dispositivo afectado. No se requiere interacci\u00f3n del usuario para explotar esta vulnerabilidad. La vulnerabilidad afecta la confidencialidad, integridad y disponibilidad del dispositivo afectado."}], "lastModified": "2020-10-02T14:09:24.937", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siemens:scalance_sc-600_firmware:2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A39EC3B9-29E8-4DF3-91FD-42FE0A4AFC3D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siemens:scalance_sc-600:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "725C671B-D7A0-48CF-8A31-5F9C4173F1DD"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "productcert@siemens.com"}