Details of VAR-201308-0351

ID

VAR-201308-0351

CVE

CVE-2013-4651

TITLE

Siemens SCALANCE W700 In the series firmware SSL Vulnerability to perform man-in-the-middle attacks on sessions

Trust: 0.8

sources: JVNDB: JVNDB-2013-003624

DESCRIPTION

Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship. The Siemens Scalance W-700 Series is an industrial wireless switch device developed by Siemens. Devices supporting IEEE 802.11a/b/g with firmware version < v4.5.4 below are affected by this vulnerability: SCALANCE W744-1, W746-1, W747-1 SCALANCE W744-1PRO, W746-1PRO, W747-1RR SCALANCE W784- 1, W784-1RR SCALANCE W786-1PRO, W786-2PRO, W786-3PRO, W786-2RR SCALANCE W788-1PRO, W788-2PRO, W788-1RR, W788-2RR. Attackers can exploit this issue to spoof a valid server and conduct man-in-the-middle attacks. Successful exploits will cause victims to accept the certificates assuming they are from a legitimate site. Siemens Scalance W-700 series running firmware versions prior to 4.5.4 are vulnerable

Trust: 2.79

sources: NVD: CVE-2013-4651 // JVNDB: JVNDB-2013-003624 // CNVD: CNVD-2013-11278 // BID: 61539 // IVD: ce0d3be0-2352-11e6-abef-000c29c66e3d // VULHUB: VHN-64653 // VULMON: CVE-2013-4651

IOT TAXONOMY

category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: ce0d3be0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-11278

AFFECTED PRODUCTS

vendor:	siemens	model:	scalance w788-2rr	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w788-1rr	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w746-1	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w747-1	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w784-1rr	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w744-1pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w788-2pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w788-1pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w786-2rr	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w786-1pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w784-1	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w746-1pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w747-1rr	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w786-2pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w786-3pro	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w744-1	scope:	eq	version:	-	Trust: 1.2
vendor:	siemens	model:	scalance w700 series	scope:	lte	version:	4.4.0	Trust: 1.0
vendor:	siemens	model:	scalance w700 series	scope:	eq	version:	4.4.0	Trust: 0.8
vendor:	siemens	model:	scalance w700 series	scope:	lt	version:	4.5.4	Trust: 0.8
vendor:	siemens	model:	scalance w744-1	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w744-1pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w746-1	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w746-1pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w747-1	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w747-1rr	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w784-1	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w784-1rr	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w786-1pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w786-2pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w786-2rr	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w786-3pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w788-1pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w788-1rr	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w788-2pro	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w788-2rr	scope:	-	version:	-	Trust: 0.8
vendor:	siemens	model:	scalance w-700 series	scope:	-	version:	-	Trust: 0.6
vendor:	siemens	model:	scalance w-7xx product family	scope:	lt	version:	4.5.4	Trust: 0.2

sources: IVD: ce0d3be0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-11278 // JVNDB: JVNDB-2013-003624 // CNNVD: CNNVD-201307-683 // NVD: CVE-2013-4651

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2013-4651
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2013-4651
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2013-11278
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201307-683
value:	MEDIUM
Trust: 0.6
IVD:	ce0d3be0-2352-11e6-abef-000c29c66e3d
value:	MEDIUM
Trust: 0.2
VULHUB:	VHN-64653
value:	MEDIUM
Trust: 0.1
VULMON:	CVE-2013-4651
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2013-4651
severity:	MEDIUM
baseScore:	6.6
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2013-11278
severity:	MEDIUM
baseScore:	6.6
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	ce0d3be0-2352-11e6-abef-000c29c66e3d
severity:	MEDIUM
baseScore:	6.6
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-64653
severity:	MEDIUM
baseScore:	6.6
vectorString:	AV:N/AC:H/AU:N/C:P/I:P/A:C
accessVector:	NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	4.9
impactScore:	8.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: IVD: ce0d3be0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-11278 // VULHUB: VHN-64653 // VULMON: CVE-2013-4651 // JVNDB: JVNDB-2013-003624 // CNNVD: CNNVD-201307-683 // NVD: CVE-2013-4651

PROBLEMTYPE DATA

problemtype:

CWE-255

Trust: 1.9

sources: VULHUB: VHN-64653 // JVNDB: JVNDB-2013-003624 // NVD: CVE-2013-4651

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201307-683

TYPE

Trust management

Trust: 0.8

sources: IVD: ce0d3be0-2352-11e6-abef-000c29c66e3d // CNNVD: CNNVD-201307-683

CONFIGURATIONS

sources: JVNDB: JVNDB-2013-003624

PATCH

title:	SSA-120908	url:	http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-120908.pdf	Trust: 0.8
title:	Siemens Scalance W-700 Series Patch with built-in SSL certificate spoofing vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/37984	Trust: 0.6

sources: CNVD: CNVD-2013-11278 // JVNDB: JVNDB-2013-003624

EXTERNAL IDS

db:	NVD	id:	CVE-2013-4651	Trust: 3.7
db:	SIEMENS	id:	SSA-120908	Trust: 2.4
db:	BID	id:	61539	Trust: 1.7
db:	CNNVD	id:	CNNVD-201307-683	Trust: 0.9
db:	ICS CERT	id:	ICSA-13-213-01	Trust: 0.9
db:	CNVD	id:	CNVD-2013-11278	Trust: 0.8
db:	JVNDB	id:	JVNDB-2013-003624	Trust: 0.8
db:	SECUNIA	id:	54168	Trust: 0.6
db:	IVD	id:	CE0D3BE0-2352-11E6-ABEF-000C29C66E3D	Trust: 0.2
db:	SEEBUG	id:	SSVID-89662	Trust: 0.1
db:	VULHUB	id:	VHN-64653	Trust: 0.1
db:	VULMON	id:	CVE-2013-4651	Trust: 0.1

sources: IVD: ce0d3be0-2352-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-11278 // VULHUB: VHN-64653 // VULMON: CVE-2013-4651 // BID: 61539 // JVNDB: JVNDB-2013-003624 // CNNVD: CNNVD-201307-683 // NVD: CVE-2013-4651

REFERENCES

url:	http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-120908.pdf	Trust: 2.4
url:	https://ics-cert.us-cert.gov/advisories/icsa-13-213-01	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4651	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4651	Trust: 0.8
url:	http://www.securityfocus.com/bid/61539	Trust: 0.7
url:	http://www.secunia.com/advisories/54168/	Trust: 0.6
url:	http://subscriber.communications.siemens.com/	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/255.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	http://tools.cisco.com/security/center/viewalert.x?alertid=30283	Trust: 0.1

sources: CNVD: CNVD-2013-11278 // VULHUB: VHN-64653 // VULMON: CVE-2013-4651 // BID: 61539 // JVNDB: JVNDB-2013-003624 // CNNVD: CNNVD-201307-683 // NVD: CVE-2013-4651

CREDITS

The vendor reported this issue.

Trust: 0.3

sources: BID: 61539

SOURCES

db:	IVD	id:	ce0d3be0-2352-11e6-abef-000c29c66e3d
db:	CNVD	id:	CNVD-2013-11278
db:	VULHUB	id:	VHN-64653
db:	VULMON	id:	CVE-2013-4651
db:	BID	id:	61539
db:	JVNDB	id:	JVNDB-2013-003624
db:	CNNVD	id:	CNNVD-201307-683
db:	NVD	id:	CVE-2013-4651

LAST UPDATE DATE

2025-04-11T22:53:17.196000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-11278	date:	2013-08-05T00:00:00
db:	VULHUB	id:	VHN-64653	date:	2013-08-01T00:00:00
db:	VULMON	id:	CVE-2013-4651	date:	2013-08-01T00:00:00
db:	BID	id:	61539	date:	2013-08-01T17:26:00
db:	JVNDB	id:	JVNDB-2013-003624	date:	2013-08-05T00:00:00
db:	CNNVD	id:	CNNVD-201307-683	date:	2013-08-07T00:00:00
db:	NVD	id:	CVE-2013-4651	date:	2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:	IVD	id:	ce0d3be0-2352-11e6-abef-000c29c66e3d	date:	2013-08-05T00:00:00
db:	CNVD	id:	CNVD-2013-11278	date:	2013-08-02T00:00:00
db:	VULHUB	id:	VHN-64653	date:	2013-08-01T00:00:00
db:	VULMON	id:	CVE-2013-4651	date:	2013-08-01T00:00:00
db:	BID	id:	61539	date:	2013-07-31T00:00:00
db:	JVNDB	id:	JVNDB-2013-003624	date:	2013-08-05T00:00:00
db:	CNNVD	id:	CNNVD-201307-683	date:	2013-07-31T00:00:00
db:	NVD	id:	CVE-2013-4651	date:	2013-08-01T13:32:26.067