A vulnerability has been identified in SCALANCE X-200 switch family (incl.

Published 7 y ago 2019-06-12 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.5

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.3%

percentile 23%

Public exploits

none known

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords.

Exploit prediction (EPSS)

0.30% probability of exploitation in the next 30 days, higher than 23% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

Siemens SCALANCE X-200 switch family (incl. SIPLUS NET variants)
Siemens SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)
Siemens SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)
Siemens SCALANCE X-414-3E

Classification

Weakness

CWE-257 Storing Passwords in a Recoverable Format
CWE-522 Insufficiently Protected Credentials

References

cert-portal.siemens.com /productcert/pdf/ssa-646841.pdf · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2019-6567
NVD: CVE-2019-6567

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary