Siemens SCALANCE X204-2

CVE-2019-6569

CRITICAL 9.1

At a glance

Source: NVD
EPSS: EPSS 1.33 % · percentile 71 (2026-10-31)
State: PUBLISHED
Published: 2019-03-26 21:12 UTC
Updated: 2024-08-04 20:23 UTC
Assigner: siemens
NVD status: Modified

Search on…

Description

The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.

Weaknesses (CWE)

CWE-440 — Expected Behavior Violation

References

https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf

Scores

Version	Score	Vector	Scored by
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.4	AV:N/AC:L/Au:N/C:P/I:N/A:P	NVD · nvd@nist.gov (Primary)

European references

ENISA EUVD · EUVD-2019-16128
GCVE · GCVE-0-2019-6569

CERT-FR advisories

CERTFR-2019-AVI-094 — SCADA Vulnérabilité dans Siemens Scalance · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:o:siemens:scalance_x-200_firmware:*:*:*:*:*:*:*:* < 5.2.4
cpe:2.3:o:siemens:scalance_x-300_firmware:*:*:*:*:*:*:*:* < 4.1.3
cpe:2.3:o:siemens:scalance_xp-200_firmware:*:*:*:*:*:*:*:* < 4.1
cpe:2.3:o:siemens:scalance_xc-200_firmware:*:*:*:*:*:*:*:* < 4.1
cpe:2.3:o:siemens:scalance_xf-200_firmware:*:*:*:*:*:*:*:* < 4.1

Affected products

Product	Versions
Siemens · SCALANCE X204-2	affected All versions < V5.2.6
Siemens · SCALANCE X204-2FM	affected All versions < V5.2.6
Siemens · SCALANCE X204-2LD	affected All versions < V5.2.6
Siemens · SCALANCE X204-2LD TS	affected All versions < V5.2.6
Siemens · SCALANCE X204-2TS	affected All versions < V5.2.6
Siemens · SCALANCE X206-1	affected All versions < V5.2.6
Siemens · SCALANCE X206-1LD	affected All versions < V5.2.6
Siemens · SCALANCE X208	affected All versions < V5.2.6
Siemens · SCALANCE X208PRO	affected All versions < V5.2.6
Siemens · SCALANCE X212-2	affected All versions < V5.2.6
Siemens · SCALANCE X212-2LD	affected All versions < V5.2.6
Siemens · SCALANCE X216	affected All versions < V5.2.6
Siemens · SCALANCE X224	affected All versions < V5.2.6
Siemens · SCALANCE X302-7 EEC (230V)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (230V, coated)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (24V)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (24V, coated)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (2x 230V)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (2x 230V, coated)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (2x 24V)	affected All versions < V4.1.3

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Siemens SCALANCE X204-2