PT-2019-4667 · Siemens · Scalance X-200Irt+2
Published
2019-08-13
·
Updated
2022-02-09
·
CVE-2019-10942
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
SCALANCE X-200 switch family versions prior to V5.2.5
SCALANCE X-200IRT switch family versions prior to V5.5.0
SCALANCE X204RNA (HSR) (all versions)
SCALANCE X204RNA (PRP) (all versions)
SCALANCE X204RNA EEC (HSR) (all versions)
SCALANCE X204RNA EEC (PRP) (all versions)
SCALANCE X204RNA EEC (PRP/HSR) (all versions)
Description
The issue is related to insufficient resources in the telnet service of the affected devices, which could allow a remote attacker to cause a denial-of-service condition by sending large message packages repeatedly to the telnet service. The security issue can be exploited by an attacker with network access to the affected systems, requiring no system privileges and no user interaction. This could compromise the availability of the device.
Recommendations
For SCALANCE X-200 switch family versions prior to V5.2.5, update to version V5.2.5 or later.
For SCALANCE X-200IRT switch family versions prior to V5.5.0, update to version V5.5.0 or later.
For SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), and SCALANCE X204RNA EEC (PRP/HSR), at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the telnet service to minimize the risk of exploitation.
RCE
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Scalance X-200
Scalance X-200Irt
Scalance X204Rna