Skip to content
OpenAdvisories
Medium SSA-951513 1 CVE

SSA-951513: Clickjacking Vulnerability in SCALANCE S, SCALANCE X-300, X-200IRT, X-200RNA and X-200 Switch Families

Published Feb 11, 2020 · Updated Dec 13, 2022 · Revision 4

Vendor: Siemens Product: SCALANCE S602 Product: SCALANCE S612 Product: SCALANCE S623 Product: SCALANCE S627-2M Product: SCALANCE X-200 switch family (incl. SIPLUS NET variants) Product: SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) Product: SCALANCE X-200RNA switch family Product: SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)

Summary

Several SCALANCE X switches contain a vulnerability that could allow an attacker to perform administrative actions
if the victim is tricked into clicking on a website controlled by the attacker.
The attack only works if the victim has an authenticated session on the administrative interface of the switch.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

Revision history

  1. #4

    Added SCALANCE X-200RNA switch family

  2. #3

    Added affected products SCALANCE S602, SCALANCE S612, SCALANCE S623, and SCALANCE S627-2M

  3. #2

    Added solution for SCALANCE X-200IRT switch family

  4. #1

    Publication Date

References