CVE-2019-13924 Security feature bypass in SCALANCE S602
Missing X-Frame-Options header allows clickjacking attacks, enabling attackers to perform administrative actions on Siemens SCALANCE devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-13924?
CVE-2019-13924 is a medium-severity vulnerability in Siemens SCALANCE S602, published on 11 Feb 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All versions < V4.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < 5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < 4.1.3). The device does not send the X-Frame-Option Header in the administrative web interface, which makes it vulnerable to Clickjacking attacks. The security vulnerability could be exploited by an attacker that is able to trick an administrative user with a valid session on the target device into clicking on a website controlled by the attacker. The vulnerability could allow an attacker to perform administrative actions via the web interface.
Which versions are affected by CVE-2019-13924?
It affects 8 products.
Products include Siemens Scalance X-200irt Firmware, Siemens Scalance X-300 Firmware, Siemens Scalance Xb-200 Firmware, Siemens Scalance Xc-200 Firmware, Siemens Scalance Xf-200 Firmware, Siemens Scalance Xp-200 Firmware and 2 more.
How do I fix CVE-2019-13924?
No fix has been published for CVE-2019-13924 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-13924 being exploited?
There is no known exploitation of CVE-2019-13924 in the wild and no public exploit code.
Other vulnerabilities in Siemens SCALANCE S602
Sources
Also known as GHSA-9v8p-c94c-q287.