Denial of service in Siemens SCALANCE X Switches



Published: 2019-08-21
Risk Medium
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2019-10942
CWE-ID N/A
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SCALANCE X-200RNA
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X-200 IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X-200
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Siemens

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Insufficient Resource Pool

EUVDB-ID: #VU20349

Risk: Medium

CVSSv3.1: 6.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2019-10942

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the device's resource pool is not large enough to handle peak demand. A remote attacker can send large message packages repeatedly to the telnet service and cause a denial of service condition.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

SCALANCE X-200RNA: All versions

SCALANCE X-200 IRT: All versions

SCALANCE X-200: All versions

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-100232.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###