CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 6.4
CWE Name:  Improper Input Validation
Summary: a vulnerability has been identified in scalance x-200 (all versions <v5.2.4), scalance x-300 (all versions), scalance xp/xc/xf-200 (all versions <v4.1). the monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. an attacker might use this behaviour to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behaviour. the security vulnerability could be exploited by an attacker with network access to the traffic-receiving network. successful exploitation requires no system privileges and no user interaction. an attacker could use the vulnerability to compromise the confidentiality and availability of the traffic-generating network. at the time of advisory publication no public exploitation of this security vulnerability was known.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/PARTIAL
Published Date: 2019-03-26
Last Modified Date: 2019-06-12
You are a cybersecurity expert assistant. Provide detailed information about vulnerabilities in a clear and structured format.
system
Please provide details about this vulnerability:  Improper Input Validation.
user
CWE Code: 20
Vulnerability Type: privilege_escalation
CVSS Score: 6.4
CWE Name:  Improper Input Validation
Summary: a vulnerability has been identified in scalance x-200 (all versions <v5.2.4), scalance x-300 (all versions), scalance xp/xc/xf-200 (all versions <v4.1). the monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. an attacker might use this behaviour to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behaviour. the security vulnerability could be exploited by an attacker with network access to the traffic-receiving network. successful exploitation requires no system privileges and no user interaction. an attacker could use the vulnerability to compromise the confidentiality and availability of the traffic-generating network. at the time of advisory publication no public exploitation of this security vulnerability was known.
Access Authentication: NONE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/NONE/PARTIAL
Published Date: 2019-03-26
Last Modified Date: 2019-06-12
assistant