How severe is CVE-2019-10927?

CVE-2019-10927 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2019-10927 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-10927?

CVE-2019-10927 primarily affects Siemens Scalance Xb-200 Firmware. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-10927?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-10927 published?

CVE-2019-10927 was published on 2019-08-13 and last updated on 2026-06-17.

CVE-2019-10927

CVE-2019-10927 is a medium-severity vulnerability in Siemens Scalance Xb-200 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-703.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 1% (64th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-703
Affected product: Siemens Scalance Xb-200 Firmware
Published: 2019-08-13
Last modified: 2026-06-17

Description

A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.

Frequently asked questions

What is CVE-2019-10927?: A vulnerability has been identified in SCALANCE SC-600 (V2.0), SCALANCE XB-200 (V4.1), SCALANCE XC-200 (V4.1), SCALANCE XF-200BA (V4.1), SCALANCE XP-200 (V4.1), SCALANCE XR-300WG (V4.1). An authenticated attacker with network access to to port 22/tcp of an affected device may cause a Denial-of-Service condition. The security vulnerability could be exploited by an authenticated attacker with network access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the availability of the affected device.
How severe is CVE-2019-10927?: CVE-2019-10927 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2019-10927 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (64th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-10927?: CVE-2019-10927 primarily affects Siemens Scalance Xb-200 Firmware. In total, 5 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-10927?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-10927 published?: CVE-2019-10927 was published on 2019-08-13 and last updated on 2026-06-17.

References

https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf

Affected products (5)

cpe:2.3:o:siemens:scalance_xb-200_firmware:4.1:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_xc-200_firmware:4.1:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_xf-200ba_firmware:4.1:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_xp-200_firmware:4.1:*:*:*:*:*:*:*
cpe:2.3:o:siemens:scalance_xr-300wg_firmware:4.1:*:*:*:*:*:*:*

More vulnerabilities in Siemens Scalance Xb-200 Firmware

CVE-2022-36323 — Critical (CVSS 9.1): Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with…
CVE-2021-25667 — High (CVSS 8.8): A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions…
CVE-2017-12736 — High (CVSS 8.8): After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain…
CVE-2022-36324 — High (CVSS 7.5): Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated…
CVE-2020-28400 — High (CVSS 7.5): Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service…
CVE-2019-19301 — High (CVSS 7.5): A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE…

All CVEs affecting Siemens Scalance Xb-200 Firmware →

Other CWE-703 vulnerabilities

CVE-2025-13026 — Critical (CVSS 9.8): Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in…
CVE-2025-13023 — Critical (CVSS 9.8): Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in…
CVE-2025-13022 — Critical (CVSS 9.8): Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and…
CVE-2025-13021 — Critical (CVSS 9.8): Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and…
CVE-2024-39815 — Critical (CVSS 9.1): Improper check or handling of exceptional conditions vulnerability affecting Vonets industrial wifi bridge relays…
CVE-2023-45927 — Critical (CVSS 9.1): S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf().

Browse all CWE-703 vulnerabilities →