CVE-2019-6585

· MEDIUMModified

← All CVEs

CVSS v3.1

6.1

EPSS

0.74%

Published

Mar 10, 2020

Modified

Nov 21, 2024

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

CWE-80CWE-79

Affected Products (8)

siemens · scalance_s602_firmware (up to 4.1)vulnerable

siemens · scalance_s602

siemens · scalance_s612_firmware (up to 4.1)vulnerable

siemens · scalance_s612

siemens · scalance_s623_firmware (up to 4.1)vulnerable

siemens · scalance_s623

siemens · scalance_s627-2m_firmware (up to 4.1)vulnerable