cnvd - cnvd-2019-27702

cnvd-2019-27702

Vulnerability from cnvd

Title: 多款Siemens产品拒绝服务漏洞（CNVD-2019-27702）

Description:

SCALANCE SC firewall用于保护受信任的工业网络免受不受信任的网络的攻击。它允许以不同的方式过滤输入和输出网络连接。SCALANCE X switches a用于连接工业组件，如可编程逻辑控制器（PLC）或人机界面（HMI）。

多款Siemens产品存在拒绝服务漏洞。攻击者可利用漏洞影响设备的可用性。

Severity: 高

Patch Name: 多款Siemens产品拒绝服务漏洞（CNVD-2019-27702）的补丁

Patch Description:

多款Siemens产品存在拒绝服务漏洞。攻击者可利用漏洞影响设备的可用性。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf

Reference: https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf

Impacted products

Name
['Siemens SCALANCE XB-200 V4.1', 'Siemens SCALANCE XC-200 V4.1', 'Siemens SCALANCE XF-200BA V4.1', 'Siemens SCALANCE XP-200 V4.1', 'Siemens SCALANCE XR-300WG V4.1']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-10927"
    }
  },
  "description": "SCALANCE SC firewall\u7528\u4e8e\u4fdd\u62a4\u53d7\u4fe1\u4efb\u7684\u5de5\u4e1a\u7f51\u7edc\u514d\u53d7\u4e0d\u53d7\u4fe1\u4efb\u7684\u7f51\u7edc\u7684\u653b\u51fb\u3002\u5b83\u5141\u8bb8\u4ee5\u4e0d\u540c\u7684\u65b9\u5f0f\u8fc7\u6ee4\u8f93\u5165\u548c\u8f93\u51fa\u7f51\u7edc\u8fde\u63a5\u3002SCALANCE X switches a\u7528\u4e8e\u8fde\u63a5\u5de5\u4e1a\u7ec4\u4ef6\uff0c\u5982\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff08PLC\uff09\u6216\u4eba\u673a\u754c\u9762\uff08HMI\uff09\u3002\n\n\u591a\u6b3eSiemens\u4ea7\u54c1\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5f71\u54cd\u8bbe\u5907\u7684\u53ef\u7528\u6027\u3002",
  "discovererName": "unknwon",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a \r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-27702",
  "openTime": "2019-08-15",
  "patchDescription": "SCALANCE SC firewall\u7528\u4e8e\u4fdd\u62a4\u53d7\u4fe1\u4efb\u7684\u5de5\u4e1a\u7f51\u7edc\u514d\u53d7\u4e0d\u53d7\u4fe1\u4efb\u7684\u7f51\u7edc\u7684\u653b\u51fb\u3002\u5b83\u5141\u8bb8\u4ee5\u4e0d\u540c\u7684\u65b9\u5f0f\u8fc7\u6ee4\u8f93\u5165\u548c\u8f93\u51fa\u7f51\u7edc\u8fde\u63a5\u3002SCALANCE X switches a\u7528\u4e8e\u8fde\u63a5\u5de5\u4e1a\u7ec4\u4ef6\uff0c\u5982\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\uff08PLC\uff09\u6216\u4eba\u673a\u754c\u9762\uff08HMI\uff09\u3002\r\n\r\n\u591a\u6b3eSiemens\u4ea7\u54c1\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u6f0f\u6d1e\u5f71\u54cd\u8bbe\u5907\u7684\u53ef\u7528\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eSiemens\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2019-27702\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SCALANCE XB-200 V4.1",
      "Siemens SCALANCE XC-200 V4.1",
      "Siemens SCALANCE XF-200BA V4.1",
      "Siemens SCALANCE XP-200 V4.1",
      "Siemens SCALANCE XR-300WG V4.1"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2019-08-14",
  "title": "\u591a\u6b3eSiemens\u4ea7\u54c1\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2019-27702\uff09"
}

CVE-2019-10927 (GCVE-0-2019-10927)

Vulnerability from cvelistv5

Published

2019-08-13 18:55

Modified

2024-08-04 22:40

Severity ?

CWE

CWE-703 - Improper Check or Handling of Exceptional Conditions

Summary

A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Siemens AG

SCALANCE SC-600

Version: V2.0

Siemens AG	SCALANCE XB-200	Version: V4.1
Siemens AG	SCALANCE XC-200	Version: V4.1
Siemens AG	SCALANCE XF-200BA	Version: V4.1
Siemens AG	SCALANCE XP-200	Version: V4.1
Siemens AG	SCALANCE XR-300WG	Version: V4.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:40:15.129Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCALANCE SC-600",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "V2.0"
            }
          ]
        },
        {
          "product": "SCALANCE XB-200",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "V4.1"
            }
          ]
        },
        {
          "product": "SCALANCE XC-200",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "V4.1"
            }
          ]
        },
        {
          "product": "SCALANCE XF-200BA",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "V4.1"
            }
          ]
        },
        {
          "product": "SCALANCE XP-200",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "V4.1"
            }
          ]
        },
        {
          "product": "SCALANCE XR-300WG",
          "vendor": "Siemens AG",
          "versions": [
            {
              "status": "affected",
              "version": "V4.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-703",
              "description": "CWE-703: Improper Check or Handling of Exceptional Conditions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-07-14T13:18:04",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2019-10927",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCALANCE SC-600",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V2.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE XB-200",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE XC-200",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE XF-200BA",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE XP-200",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V4.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE XR-300WG",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "V4.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens AG"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-703: Improper Check or Handling of Exceptional Conditions"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2019-10927",
    "datePublished": "2019-08-13T18:55:57",
    "dateReserved": "2019-04-08T00:00:00",
    "dateUpdated": "2024-08-04T22:40:15.129Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted