Sign-up

ID

VAR-201909-0864


CVE

CVE-2019-13923


TITLE

Siemens IE/WSN-PA Link WirelessHART Gateway Cross-Site Scripting Vulnerability

Trust: 0.8

sources: IVD: 4a774231-21cb-486e-b391-9a0e6e02394c // CNVD: CNVD-2019-31386

DESCRIPTION

A vulnerability has been identified in IE/WSN-PA Link WirelessHART Gateway (All versions). The integrated configuration web server of the affected device could allow Cross-Site Scripting (XSS) attacks if unsuspecting users are tricked into accessing a malicious link. User interaction is required for a successful exploitation. The user must be logged into the web interface in order for the exploitation to succeed. At the stage of publishing this security advisory no public exploitation is known. IE/WSN-PA Link WirelessHART Gateway Contains a cross-site scripting vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. IE/WSN-PA Link is a gateway that connects a WirelessHART network to Industrial Ethernet. The vulnerability stems from the lack of proper validation of client data for web applications. An attacker could exploit the vulnerability to execute client code

Trust: 2.43

sources: NVD: CVE-2019-13923 // JVNDB: JVNDB-2019-009306 // CNVD: CNVD-2019-31386 // IVD: 4a774231-21cb-486e-b391-9a0e6e02394c // VULHUB: VHN-145818

IOT TAXONOMY

category:['ICS', 'Network device']sub_category: -

Trust: 0.6

category:['ICS']sub_category: -

Trust: 0.2

category:['network device']sub_category:gateway

Trust: 0.1

sources: OTHER: None // IVD: 4a774231-21cb-486e-b391-9a0e6e02394c // CNVD: CNVD-2019-31386

AFFECTED PRODUCTS

vendor:siemensmodel:ie\/wsn-pa link wirelesshart gatewayscope:eqversion:*

Trust: 1.0

vendor:siemensmodel:ie/wsn-pa link wirelesshart gatewayscope: - version: -

Trust: 0.8

vendor:siemensmodel:ie/wsn-pa linkscope: - version: -

Trust: 0.6

vendor:ie wsn pa link wirelesshart gatewaymodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: 4a774231-21cb-486e-b391-9a0e6e02394c // CNVD: CNVD-2019-31386 // JVNDB: JVNDB-2019-009306 // NVD: CVE-2019-13923

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-13923
value: CRITICAL

Trust: 1.0

NVD: CVE-2019-13923
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2019-31386
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201909-459
value: CRITICAL

Trust: 0.6

IVD: 4a774231-21cb-486e-b391-9a0e6e02394c
value: CRITICAL

Trust: 0.2

VULHUB: VHN-145818
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-13923
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-31386
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 4a774231-21cb-486e-b391-9a0e6e02394c
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-145818
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-13923
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2019-13923
baseSeverity: CRITICAL
baseScore: 9.6
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: 4a774231-21cb-486e-b391-9a0e6e02394c // CNVD: CNVD-2019-31386 // VULHUB: VHN-145818 // JVNDB: JVNDB-2019-009306 // CNNVD: CNNVD-201909-459 // NVD: CVE-2019-13923

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.9

problemtype:CWE-80

Trust: 1.0

sources: VULHUB: VHN-145818 // JVNDB: JVNDB-2019-009306 // NVD: CVE-2019-13923

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201909-459

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201909-459

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-009306

PATCH
title:SSA-191683url:https://cert-portal.siemens.com/productcert/pdf/ssa-191683.pdf
Trust: 0.8
title:Siemens IE/WSN-PA Link WirelessHART Gateway Cross-Site Scripting Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/180399
Trust: 0.6
title:Siemens IE-WSN-PA Link WirelessHART Gateway Fixes for cross-site scripting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=98052
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-31386 // 
            
            
            
            JVNDB: JVNDB-2019-009306 // 
            
            
            
            CNNVD: CNNVD-201909-459

EXTERNAL IDS
db:NVDid:CVE-2019-13923
Trust: 3.4
db:ICS CERTid:ICSA-19-253-04
Trust: 3.1
db:SIEMENSid:SSA-191683
Trust: 1.7
db:CNNVDid:CNNVD-201909-459
Trust: 0.9
db:CNVDid:CNVD-2019-31386
Trust: 0.8
db:JVNDBid:JVNDB-2019-009306
Trust: 0.8
db:AUSCERTid:ESB-2019.3445
Trust: 0.6
db:IVDid:4A774231-21CB-486E-B391-9A0E6E02394C
Trust: 0.2
db:OTHERid:NONE
Trust: 0.1
db:VULHUBid:VHN-145818
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            IVD: 4a774231-21cb-486e-b391-9a0e6e02394c // 
            
            
            
            CNVD: CNVD-2019-31386 // 
            
            
            
            VULHUB: VHN-145818 // 
            
            
            
            JVNDB: JVNDB-2019-009306 // 
            
            
            
            CNNVD: CNNVD-201909-459 // 
            
            
            
            NVD: CVE-2019-13923

REFERENCES
url:https://www.us-cert.gov/ics/advisories/icsa-19-253-04
Trust: 3.1
url:https://cert-portal.siemens.com/productcert/pdf/ssa-191683.pdf
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2019-13923
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13923
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2019.3445/
Trust: 0.6
url:https://ieeexplore.ieee.org/abstract/document/10769424
Trust: 0.1
sources:
            
            
            OTHER: None // 
            
            
            
            CNVD: CNVD-2019-31386 // 
            
            
            
            VULHUB: VHN-145818 // 
            
            
            
            JVNDB: JVNDB-2019-009306 // 
            
            
            
            CNNVD: CNNVD-201909-459 // 
            
            
            
            NVD: CVE-2019-13923

SOURCES
db:OTHERid: - 
db:IVDid:4a774231-21cb-486e-b391-9a0e6e02394c
db:CNVDid:CNVD-2019-31386
db:VULHUBid:VHN-145818
db:JVNDBid:JVNDB-2019-009306
db:CNNVDid:CNNVD-201909-459
db:NVDid:CVE-2019-13923

LAST UPDATE DATE
2025-01-30T20:38:59.041000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-31386date:2019-09-16T00:00:00
db:VULHUBid:VHN-145818date:2019-09-24T00:00:00
db:JVNDBid:JVNDB-2019-009306date:2019-10-04T00:00:00
db:CNNVDid:CNNVD-201909-459date:2019-09-30T00:00:00
db:NVDid:CVE-2019-13923date:2024-11-21T04:25:42.430

SOURCES RELEASE DATE
db:IVDid:4a774231-21cb-486e-b391-9a0e6e02394cdate:2019-09-16T00:00:00
db:CNVDid:CNVD-2019-31386date:2019-09-16T00:00:00
db:VULHUBid:VHN-145818date:2019-09-13T00:00:00
db:JVNDBid:JVNDB-2019-009306date:2019-09-18T00:00:00
db:CNNVDid:CNNVD-201909-459date:2019-09-10T00:00:00
db:NVDid:CVE-2019-13923date:2019-09-13T17:15:11.977