CVE-2019-13933 — A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA

A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA EEC (PRP/HSR), SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-

01What is this vulnerability?

A vulnerability has been identified in SCALANCE X204RNA (HSR), SCALANCE X204RNA (PRP), SCALANCE X204RNA EEC (HSR), SCALANCE X204RNA EEC (PRP), SCALANCE X204RNA EEC (PRP/HSR), SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x…

02Affected products

Vendor	Product	Versions
Siemens	SCALANCE X204RNA (HSR)	All versions < V3.2.7
Siemens	SCALANCE X204RNA (PRP)	All versions < V3.2.7
Siemens	SCALANCE X204RNA EEC (HSR)	All versions < V3.2.7
Siemens	SCALANCE X204RNA EEC (PRP)	All versions < V3.2.7
Siemens	SCALANCE X204RNA EEC (PRP/HSR)	All versions < V3.2.7
Siemens	SCALANCE X302	7 EEC (230V) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (230V, coated) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (24V) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (24V, coated) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (2x 230V) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (2x 230V, coated) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (2x 24V) — All versions < V4.1.3
Siemens	SCALANCE X302	7 EEC (2x 24V, coated) — All versions < V4.1.3
Siemens	SCALANCE X304	2FE — All versions < V4.1.3
Siemens	SCALANCE X306	1LD FE — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (230V) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (230V, coated) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (24V) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (24V, coated) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (2x 230V) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (2x 230V, coated) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (2x 24V) — All versions < V4.1.3
Siemens	SCALANCE X307	2 EEC (2x 24V, coated) — All versions < V4.1.3
Siemens	SCALANCE X307	3 — All versions < V4.1.3
Siemens	SCALANCE X307	3 — All versions < V4.1.3
Siemens	SCALANCE X307	3LD — All versions < V4.1.3
Siemens	SCALANCE X307	3LD — All versions < V4.1.3
Siemens	SCALANCE X308	2 — All versions < V4.1.3
Siemens	SCALANCE X308	2 — All versions < V4.1.3
Siemens	SCALANCE X308	2LD — All versions < V4.1.3
Siemens	SCALANCE X308	2LD — All versions < V4.1.3
Siemens	SCALANCE X308	2LH — All versions < V4.1.3
Siemens	SCALANCE X308	2LH — All versions < V4.1.3
Siemens	SCALANCE X308	2LH+ — All versions < V4.1.3
Siemens	SCALANCE X308	2LH+ — All versions < V4.1.3
Siemens	SCALANCE X308	2M — All versions < V4.1.3
Siemens	SCALANCE X308	2M — All versions < V4.1.3
Siemens	SCALANCE X308	2M PoE — All versions < V4.1.3
Siemens	SCALANCE X308	2M PoE — All versions < V4.1.3
Siemens	SCALANCE X308	2M TS — All versions < V4.1.3
Siemens	SCALANCE X308	2M TS — All versions < V4.1.3
Siemens	SCALANCE X310	All versions < V4.1.3
Siemens	SCALANCE X310	All versions < V4.1.3
Siemens	SCALANCE X310FE	All versions < V4.1.3
Siemens	SCALANCE X310FE	All versions < V4.1.3
Siemens	SCALANCE X320	1 FE — All versions < V4.1.3
Siemens	SCALANCE X320	1-2LD FE — All versions < V4.1.3
Siemens	SCALANCE X408	2 — All versions < V4.1.3
Siemens	SCALANCE XR324	12M (230V, ports on front) — All versions < V4.1.3
Siemens	SCALANCE XR324	12M (230V, ports on front) — All versions < V4.1.3

03Active exploitation status

Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.

04Recommended remediation

• Patch to a fixed version listed in the vendor advisory (see references below).
• Mitigate with WAF rules, network egress filters, or feature flags where the patch is not yet available.
• Hunt historical logs for exploitation indicators — see Detection signatures below.

05Technical details

For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.

06Detection signatures

Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.

07Related CVEs

No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.

08Timeline

• Published: 2020-01-16T00:00:00.000Z
• Last modified: 2024-08-05T00:05:43.965Z

09References

• cert-portal.siemens.com — https://cert-portal.siemens.com/productcert/pdf/ssa-443566.pdf
• www.us-cert.gov — https://www.us-cert.gov/ics/advisories/icsa-20-014-03