PT-2018-2164 · Siemens · Scalance S612+3

Published 2018-11-13 · Updated 2019-10-09 · CVE-2018-16555

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SCALANCE S602 versions prior to 4.0.1.1 SCALANCE S612 versions prior to 4.0.1.1 SCALANCE S623 versions prior to 4.0.1.1 SCALANCE S627-2M versions prior to 4.0.1.1

Description A vulnerability has been identified that could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation, and the user must be logged into the web interface. The issue is related to insufficient protection of the web page structure. At the time of publishing, no public exploitation is known.

Recommendations For SCALANCE S602 versions prior to 4.0.1.1, update to version 4.0.1.1 or later. For SCALANCE S612 versions prior to 4.0.1.1, update to version 4.0.1.1 or later. For SCALANCE S623 versions prior to 4.0.1.1, update to version 4.0.1.1 or later. For SCALANCE S627-2M versions prior to 4.0.1.1, update to version 4.0.1.1 or later.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2019-00117

CVE-2018-16555

Affected Products

Scalance S602

Scalance S612

Scalance S623

Scalance S627-2M

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-16555 · Security Note
• https://bdu.fstec.ru/vul/2019-00117 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16555 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-242982.pdf · Vendor Advisory
• http://securityfocus.com/bid/105937 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-317-04 · Note