CVE-2019-10927 Denial of service in SCALANCE SC-600
An authenticated attacker can cause a denial-of-service condition on Siemens SCALANCE network devices via port 22.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10927?
CVE-2019-10927 is a medium-severity denial of service vulnerability in Siemens AG SCALANCE SC-600, published on 13 Aug 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
Weakness: CWE-703
Which versions are affected by CVE-2019-10927?
It affects 5 products.
Products include Siemens Scalance Xb-200 Firmware, Siemens Scalance Xc-200 Firmware, Siemens Scalance Xf-200ba Firmware, Siemens Scalance Xp-200 Firmware, Siemens Scalance Xr-300wg Firmware.
How do I fix CVE-2019-10927?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2019-10927 being exploited?
There is no known exploitation of CVE-2019-10927 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2019-10927, GHSA-qwf6-8cjr-7638.