XSS in Siemens Scalance S602
CVE-2018-16555
A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All versions < V4.0.1.1), SCALANCE S627-2M (All versions < V4.0.1.1). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.
EPSS: 0.007 (49.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Siemens Scalance_s602
- Siemens Scalance_s602_firmware
- Siemens Scalance_s612
- Siemens Scalance_s612_firmware
- Siemens Scalance_s623
- Siemens Scalance_s623_firmware
- Siemens Scalance_s627-2m
- Siemens Scalance_s627-2m_firmware
- Siemens Ag Scalance S602, S612, S623, S627-2m — versions SCALANCE S623 : All versions < V4.0.1.1, SCALANCE S602 : All versions < V4.0.1.1, SCALANCE S627-2M : All versions < V4.0.1.1
Weakness classification (CWE)
References
- productcert@siemens.com (x_refsource_CONFIRM, Vendor Advisory)
- productcert@siemens.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
Frequently asked questions
- What is CVE-2018-16555?
- CVE-2018-16555 is a medium-severity vulnerability in Siemens Scalance S602, classified under Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS). CVSS score: 5.4/10. Published 2018-12-13.
- How severe is CVE-2018-16555?
- Medium severity. CVSS v3 base score is 5.4 out of 10.