CVE-2019-6585

MEDIUM

SCALANCE S602/S612/S623/S627-2M Firmware 3.0-4.1 Authenticated Stored XSS via Configuration Web Server

Title source: llm
STIX 2.1

Description

A vulnerability has been identified in SCALANCE S602 (All versions >= V3.0 and < V4.1), SCALANCE S612 (All versions >= V3.0 and < V4.1), SCALANCE S623 (All versions >= V3.0 and < V4.1), SCALANCE S627-2M (All versions >= V3.0 and < V4.1). The integrated configuration web server of the affected devices could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed.

References (2)

Core 2
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.us-cert.gov/ics/advisories/icsa-20-042-10

Scores

CVSS v3 6.1
EPSS 0.0034
EPSS Percentile 56.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-80 CWE-79
Status published
Products (4)
siemens/scalance_s602_firmware 3.0 - 4.1
siemens/scalance_s612_firmware 3.0 - 4.1
siemens/scalance_s623_firmware 3.0 - 4.1
siemens/scalance_s627-2m_firmware 3.0 - 4.1
Published Mar 10, 2020
Tracked Since Feb 18, 2026