CVE-2016-7090

MEDIUM

Siemens SCALANCE M-800 and S615 Firmware < 4.02 - Session Cookie Exposure via Missing Secure Flag

Title source: llm

Description

The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

References (3)

Core 3

Core References

Third Party Advisory, US Government Resource x_refsource_misc

https://ics-cert.us-cert.gov/advisories/ICSA-16-271-01

Vendor Advisory x_refsource_confirm

http://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-342135.pdf

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/93115

Scores

CVSS v3 4.0

EPSS 0.0029

EPSS Percentile 52.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

siemens/scalance_m-800_firmware < 4.01

siemens/scalance_s615_firmware < 4.01

Published Sep 29, 2016

Tracked Since Feb 18, 2026