PT-2019-4791 · Siemens · Scalance Sc-600

Published 2019-08-13 · Updated 2020-10-02 · CVE-2019-10928

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SCALANCE SC-600 version V2.0

Description A vulnerability has been identified that allows an authenticated attacker with physical access to the device and access to port 22/tcp to execute arbitrary commands. The vulnerability can be exploited without user interaction and impacts the confidentiality, integrity, and availability of the device. It is related to incorrect handling of exceptional states, which may allow an attacker to execute arbitrary code.

Recommendations For SCALANCE SC-600 version V2.0, consider restricting physical access to the device and limiting access to port 22/tcp to minimize the risk of exploitation. As a temporary workaround, consider disabling access to the device until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-703

Related Identifiers

BDU:2020-01369

CVE-2019-10928

Affected Products

Scalance Sc-600

References · 5

• https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-10928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10928 · Security Note
• https://bdu.fstec.ru/vul/2020-01369 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-227-03 · Note