VulnerabilityModified

CVE-2013-3633

A vulnerability has been identified in SCALANCE X-200 switch family (incl.

HIGH 8.0EPSS 1.20%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.20%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions < V5.0.0 for CVE-2013-3633 and versions < V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.

CVSS 2.0: 8.0 HIGHAV:N/AC:L/Au:S/C:P/I:P/A:C
EPSS: 1.20% probability · 66th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: siemens/scalance x200irt firmware · siemens/scalance x200-4p irt · siemens/scalance x201-3p irt · siemens/scalance x202-2irt · siemens/scalance x202-2p irt · siemens/scalance x204irt · siemens/scalance xf204irt
Source: cve@mitre.org

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.