Description
A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SCALANCE S602 | All versions >= V3.0 and < V4.1 | — |
| Siemens | SCALANCE S612 | All versions >= V3.0 and < V4.1 | — |
| Siemens | SCALANCE S623 | All versions >= V3.0 and < V4.1 | — |
| Siemens | SCALANCE S627-2M | All versions >= V3.0 and < V4.1 | — |
Advisories 2
- ICSA-20-042-10 Siemens SCALANCE S-600 (Update B) CISA ICS & IT advisories · May 6, 2025
- SSA-591405 SSA-591405: Web Vulnerabilities in SCALANCE S-600 Family Siemens ProductCERT · Apr 13, 2021