1. CVE-Search
  2. CVE-2013-5709
ID CVE-2013-5709
Summary The authentication implementation in the web server on Siemens SCALANCE X-200 switches with firmware before 5.0.0 does not use a sufficient source of entropy for generating values of random numbers, which makes it easier for remote attackers to hijack sessions by predicting a value.
References
Vulnerable Configurations
  • cpe:2.3:o:siemens:scalance_x-200_series_firmware:4.3:*:*:*:*:*:*:*
    cpe:2.3:o:siemens:scalance_x-200_series_firmware:4.3:*:*:*:*:*:*:*
  • cpe:2.3:o:siemens:scalance_x-200_series_firmware:4.4:*:*:*:*:*:*:*
    cpe:2.3:o:siemens:scalance_x-200_series_firmware:4.4:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x-200:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x-200:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x-200rna:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x-200rna:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x200-4p_irt:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x200-4p_irt:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x201-3p_irt:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x201-3p_irt:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x201-3p_irt:-:-:pro:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x201-3p_irt:-:-:pro:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x202-2irt:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x202-2irt:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x202-2p_irt:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x202-2p_irt:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x202-2p_irt:-:-:pro:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x202-2p_irt:-:-:pro:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x204irt:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x204irt:-:*:*:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_x204irt:-:-:pro:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_x204irt:-:-:pro:*:*:*:*:*
  • cpe:2.3:h:siemens:scalance_xf-200:-:*:*:*:*:*:*:*
    cpe:2.3:h:siemens:scalance_xf-200:-:*:*:*:*:*:*:*
CVSS
Base: 8.3 (as of 10-02-2020 - 15:15)
Impact:
Exploitability:
CWE CWE-189
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL PARTIAL COMPLETE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:P/A:C
refmap via4
confirm
misc http://ics-cert.us-cert.gov/advisories/ICSA-13-254-01
Last major update 10-02-2020 - 15:15
Published 17-09-2013 - 12:04
Last modified 10-02-2020 - 15:15
Back to Top