CVE-2016-7090
MEDIUMSiemens Scalance M-800 Firmware < 4.01 - Information Disclosure
Title source: ruleDescription
The integrated web server on Siemens SCALANCE M-800 and S615 modules with firmware before 4.02 does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Scores
CVSS v3
4.0
EPSS
0.0067
EPSS Percentile
71.1%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N
Classification
CWE
CWE-200
Status
published
Affected Products (3)
n/a/n/a
siemens/scalance_m-800_firmware
< 4.01
siemens/scalance_s615_firmware
< 4.01
Timeline
Published
Sep 29, 2016
Tracked Since
Feb 18, 2026