CVE-2019-6567 : Vulnerability Insights and Analysis

A security issue has been found in various models of the SCALANCE X switch family, including SIPLUS NET variants, with versions below V5.2.4. This issue also affects the SCALANCE X-200IRT switch family, including SIPLUS NET variants, with versions below V5.5.0, the SCALANCE X-300 switch family, including X408 and SIPLUS NET variants, with versions below V4.1.3, and the SCALANCE X-414-3E with all versions. These devices have a vulnerability where passwords are stored in a way that can be recovered. Attackers can potentially access and retrieve passwords from the device configuration if they have access to a device configuration backup. This exploit impacts the confidentiality of the stored passwords.

Understanding CVE-2019-6567

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All Versions < V5.2.4), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X-414-3E (All versions). The affected devices store passwords in a recoverable format. An attacker may extract and recover device passwords from the device configuration. Successful exploitation requires access to a device configuration backup and impacts confidentiality of the stored passwords.

What is CVE-2019-6567?

CWE-257: Storing Passwords in a Recoverable Format

The Impact of CVE-2019-6567

Attackers can access and retrieve passwords from device configurations, compromising password confidentiality.

Technical Details of CVE-2019-6567

A security vulnerability affecting Siemens SCALANCE X switch family and related variants.

Vulnerability Description

Passwords stored in a recoverable format, allowing attackers to extract them from device configurations.

Affected Systems and Versions

SCALANCE X-200 switch family (incl. SIPLUS NET variants) - All Versions < V5.2.4
SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) - All versions < V5.5.0
SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) - All versions < V4.1.3
SCALANCE X-414-3E - All versions

Exploitation Mechanism

Attackers need access to a device configuration backup to exploit the vulnerability.

Mitigation and Prevention

Steps to address and prevent the CVE-2019-6567 vulnerability.

Immediate Steps to Take

Regularly monitor and restrict access to device configuration backups.
Implement strong password policies and encryption methods.

Long-Term Security Practices

Conduct regular security audits and penetration testing.
Keep devices and software up to date with the latest security patches.

Patching and Updates

Apply patches and updates provided by Siemens to address the vulnerability.