cnvd - cnvd-2021-02596

cnvd-2021-02596

Vulnerability from cnvd

Title: Scalance X Products关键功能认证缺失漏洞

Description:

SCALANCE X是一个开关用于连接工业部件，例如：可编程逻辑控制器(plc)或人机界面(HMIs)。

Scalance X Products关键功能认证缺失漏洞，攻击者可利用该漏洞通过网络重新启动设备。

Severity: 高

Patch Name: Scalance X Products关键功能认证缺失漏洞的补丁

Patch Description:

SCALANCE X是一个开关用于连接工业部件，例如：可编程逻辑控制器(plc)或人机界面(HMIs)。

Scalance X Products关键功能认证缺失漏洞，攻击者可利用该漏洞通过网络重新启动设备。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布相关漏洞补丁链接，请及时更新： https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf

Reference: https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf

Impacted products

Name
['Siemens SCALANCE X-200IRT switch family (incl. SIPLUSNET variants)', 'Siemens SCALANCE X-200 switch family (incl. SIPLUSNET variants)']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-15799"
    }
  },
  "description": "SCALANCE X\u662f\u4e00\u4e2a\u5f00\u5173\u7528\u4e8e\u8fde\u63a5\u5de5\u4e1a\u90e8\u4ef6\uff0c\u4f8b\u5982\uff1a\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668(plc)\u6216\u4eba\u673a\u754c\u9762(HMIs)\u3002\n\nScalance X Products\u5173\u952e\u529f\u80fd\u8ba4\u8bc1\u7f3a\u5931\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7f51\u7edc\u91cd\u65b0\u542f\u52a8\u8bbe\u5907\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u76f8\u5173\u6f0f\u6d1e\u8865\u4e01\u94fe\u63a5\uff0c\u8bf7\u53ca\u65f6\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-02596",
  "openTime": "2021-01-13",
  "patchDescription": "SCALANCE X\u662f\u4e00\u4e2a\u5f00\u5173\u7528\u4e8e\u8fde\u63a5\u5de5\u4e1a\u90e8\u4ef6\uff0c\u4f8b\u5982\uff1a\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668(plc)\u6216\u4eba\u673a\u754c\u9762(HMIs)\u3002\r\n\r\nScalance X Products\u5173\u952e\u529f\u80fd\u8ba4\u8bc1\u7f3a\u5931\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u7f51\u7edc\u91cd\u65b0\u542f\u52a8\u8bbe\u5907\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Scalance X Products\u5173\u952e\u529f\u80fd\u8ba4\u8bc1\u7f3a\u5931\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Siemens SCALANCE X-200IRT switch family (incl. SIPLUSNET variants)",
      "Siemens SCALANCE X-200 switch family (incl.  SIPLUSNET variants)"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2021-01-13",
  "title": "Scalance X Products\u5173\u952e\u529f\u80fd\u8ba4\u8bc1\u7f3a\u5931\u6f0f\u6d1e"
}

CVE-2020-15799 (GCVE-0-2020-15799)

Vulnerability from cvelistv5

Published

2021-01-12 20:18

Modified

2024-08-04 13:30

Severity ?

CWE

CWE-306 - Missing Authentication for Critical Function

Summary

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products.

References

▼	URL	Tags
	https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Siemens

SCALANCE X-200 switch family (incl. SIPLUS NET variants)

Version: All versions < V5.2.5

Siemens

SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)

Version: All versions < V5.5.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:30:21.812Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCALANCE X-200 switch family (incl. SIPLUS NET variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V5.2.5"
            }
          ]
        },
        {
          "product": "SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V5.5.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions \u003c V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-306",
              "description": "CWE-306: Missing Authentication for Critical Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-09-14T10:47:08",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2020-15799",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCALANCE X-200 switch family (incl. SIPLUS NET variants)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V5.2.5"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V5.5.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions \u003c V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-306: Missing Authentication for Critical Function"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2020-15799",
    "datePublished": "2021-01-12T20:18:33",
    "dateReserved": "2020-07-15T00:00:00",
    "dateUpdated": "2024-08-04T13:30:21.812Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted