CVE-2018-16555 — Vulnetix

CVE-2018-16555 PUBLISHED CVSS 3.5 LOW

A vulnerability has been identified in SCALANCE S602 (All versions < V4.0.1.1), SCALANCE S612 (All versions < V4.0.1.1), SCALANCE S623 (All versions < V4.0.1.1), SCALANCE S627-2M (All versions < V4.0.1.1). The integrated web server could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known.

EPSS 0.22% · 45.1th percentile

Risk Scores

CVSS 2.0

3.5

EPSS Score

0.22%

45.1th percentile

Affected Products

Vendor	Product	Versions
siemens	scalance_s627-2m_firmware	0
Siemens AG	SCALANCE S602, SCALANCE S612, SCALANCE S623, SCALANCE S627-2M	SCALANCE S602 : All versions < V4.0.1.1, SCALANCE S623 : All versions < V4.0.1.1, *
siemens	scalance_s612_firmware	0
siemens	scalance_s623_firmware	0
siemens	scalance_s602_firmware	0

Exploit Intelligence

https://cert-portal.siemens.com/productcert/pdf/ssa-242982.pdf (circl)
105937 (circl)

Timeline

Nov 13, 2018 CVE Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Oct 26, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Feb 28, 2022 EPSS Score
May 2, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Nov 6, 2022 EPSS Score
Jan 8, 2023 EPSS Score

References

Open in Interactive Console →