How severe is CVE-2019-10928?

CVE-2019-10928 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2019-10928 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-10928?

CVE-2019-10928 affects Siemens Scalance Sc-600 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2019-10928?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-10928 published?

CVE-2019-10928 was published on 2019-08-13 and last updated on 2026-06-17.

CVE-2019-10928

CVE-2019-10928 is a medium-severity vulnerability in Siemens Scalance Sc-600 Firmware with a CVSS 3.x base score of 6.6. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-703.

Key facts

Severity: Medium (CVSS 3.x base score 6.6)
CVSS v2: 4.6
EPSS exploit prediction: 0% (33rd percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-703
Affected product: Siemens Scalance Sc-600 Firmware
Published: 2019-08-13
Last modified: 2026-06-17

Description

A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.

Frequently asked questions

What is CVE-2019-10928?: A vulnerability has been identified in SCALANCE SC-600 (V2.0). An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated attacker with physical access to the affected device. No user interaction is required to exploit this vulnerability. The vulnerability impacts the confidentiality, integrity and availability of the affected device.
How severe is CVE-2019-10928?: CVE-2019-10928 has a CVSS 3.x base score of 6.6, rated medium severity. It is exploitable over physical access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2019-10928 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (33rd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-10928?: CVE-2019-10928 affects Siemens Scalance Sc-600 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2019-10928?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-10928 published?: CVE-2019-10928 was published on 2019-08-13 and last updated on 2026-06-17.

References

https://cert-portal.siemens.com/productcert/pdf/ssa-671286.pdf

Affected products (1)

cpe:2.3:o:siemens:scalance_sc-600_firmware:2.0:*:*:*:*:*:*:*

More vulnerabilities in Siemens Scalance Sc-600 Firmware

CVE-2022-36323 — Critical (CVSS 9.1): Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with…
CVE-2021-25676 — High (CVSS 7.5): A vulnerability has been identified in RUGGEDCOM RM1224 (V6.3), SCALANCE M-800 (V6.3), SCALANCE S615 (V6.3), SCALANCE…
CVE-2018-5391 — High (CVSS 7.5): The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified…
CVE-2022-36325 — Medium (CVSS 6.8): Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow…
CVE-2021-3449 — Medium (CVSS 5.9): An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a…

All CVEs affecting Siemens Scalance Sc-600 Firmware →

Other CWE-703 vulnerabilities

CVE-2025-13026 — Critical (CVSS 9.8): Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in…
CVE-2025-13023 — Critical (CVSS 9.8): Sandbox escape due to incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in…
CVE-2025-13022 — Critical (CVSS 9.8): Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and…
CVE-2025-13021 — Critical (CVSS 9.8): Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 145 and…
CVE-2024-39815 — Critical (CVSS 9.1): Improper check or handling of exceptional conditions vulnerability affecting Vonets industrial wifi bridge relays…
CVE-2023-45927 — Critical (CVSS 9.1): S-Lang 2.3.2 was discovered to contain an arithmetic exception via the function tt_sprintf().

Browse all CWE-703 vulnerabilities →