Siemens SCALANCE X204-2

CVE-2019-6569

CRITICAL 9.1

En bref

Source: NVD
EPSS: EPSS 1.33 % · centile 71 (2026-10-31)
État: PUBLISHED
Publiée: 2019-03-26 21:12 UTC
Mise à jour: 2024-08-04 20:23 UTC
Attribuée par: siemens
Statut NVD: Modified

Rechercher sur…

Description

The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.

Faiblesses (CWE)

CWE-440 — Expected Behavior Violation

Références

https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	CRITICAL 9.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.4	AV:N/AC:L/Au:N/C:P/I:N/A:P	NVD · nvd@nist.gov (Primary)

Références européennes

ENISA EUVD · EUVD-2019-16128
GCVE · GCVE-0-2019-6569

Avis du CERT-FR

CERTFR-2019-AVI-094 — SCADA Vulnérabilité dans Siemens Scalance · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

cpe:2.3:o:siemens:scalance_x-200_firmware:*:*:*:*:*:*:*:* < 5.2.4
cpe:2.3:o:siemens:scalance_x-300_firmware:*:*:*:*:*:*:*:* < 4.1.3
cpe:2.3:o:siemens:scalance_xp-200_firmware:*:*:*:*:*:*:*:* < 4.1
cpe:2.3:o:siemens:scalance_xc-200_firmware:*:*:*:*:*:*:*:* < 4.1
cpe:2.3:o:siemens:scalance_xf-200_firmware:*:*:*:*:*:*:*:* < 4.1

Produits affectés

Produit	Versions
Siemens · SCALANCE X204-2	affected All versions < V5.2.6
Siemens · SCALANCE X204-2FM	affected All versions < V5.2.6
Siemens · SCALANCE X204-2LD	affected All versions < V5.2.6
Siemens · SCALANCE X204-2LD TS	affected All versions < V5.2.6
Siemens · SCALANCE X204-2TS	affected All versions < V5.2.6
Siemens · SCALANCE X206-1	affected All versions < V5.2.6
Siemens · SCALANCE X206-1LD	affected All versions < V5.2.6
Siemens · SCALANCE X208	affected All versions < V5.2.6
Siemens · SCALANCE X208PRO	affected All versions < V5.2.6
Siemens · SCALANCE X212-2	affected All versions < V5.2.6
Siemens · SCALANCE X212-2LD	affected All versions < V5.2.6
Siemens · SCALANCE X216	affected All versions < V5.2.6
Siemens · SCALANCE X224	affected All versions < V5.2.6
Siemens · SCALANCE X302-7 EEC (230V)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (230V, coated)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (24V)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (24V, coated)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (2x 230V)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (2x 230V, coated)	affected All versions < V4.1.3
Siemens · SCALANCE X302-7 EEC (2x 24V)	affected All versions < V4.1.3

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

💣 Siemens SCALANCE X204-2