{"id":"CVE-2013-3633","aliases":["EUVD-2013-3566","GHSA-jpxf-vxxr-4pvx"],"status":"published","title":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) ...","description":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions \u003c V5.0.0 for CVE-2013-3633 and versions \u003c V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.","severity":{"version":"2.0","score":8,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01197,"percentile":0.68317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2013-05-24T20:00:00Z","modified":"2026-06-16T23:55:32Z","products":[{"vendor":"siemens","product":"scalance_x200-4p_irt"},{"vendor":"siemens","product":"scalance_x200irt_firmware"},{"vendor":"siemens","product":"scalance_x201-3p_irt"},{"vendor":"siemens","product":"scalance_x202-2irt"},{"vendor":"siemens","product":"scalance_x202-2p_irt"},{"vendor":"siemens","product":"scalance_x204irt"},{"vendor":"siemens","product":"scalance_xf204irt"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-170686.pdf","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-3633"},{"url":"https://github.com/advisories/GHSA-jpxf-vxxr-4pvx"}],"sources":{"cve":[{"id":"CVE-2013-3633","description":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions \u003c V5.0.0 for CVE-2013-3633 and versions \u003c V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.","status":"published","published":"2013-05-24T20:00:00Z","modified":"2024-08-06T16:14:56.558Z","updated_at":"2026-11-02T14:34:56.872243Z"}],"euvd":[{"id":"EUVD-2013-3566","description":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions \u003c V5.0.0 for CVE-2013-3633 and versions \u003c V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.","status":"published","published":"2013-05-24T20:00:00Z","modified":"2024-08-06T16:14:56Z","updated_at":"2026-11-03T01:56:34.623989Z"}],"ghsa":[{"id":"GHSA-jpxf-vxxr-4pvx","title":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) ...","description":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions \u003c V5.0.0 for CVE-2013-3633 and versions \u003c V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.","status":"published","published":"2022-05-13T01:30:17Z","modified":"2023-02-01T05:08:12Z","updated_at":"2026-11-02T14:50:42.317052Z"}],"nvd":[{"id":"CVE-2013-3633","description":"A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Versions \u003c V5.0.0 for CVE-2013-3633 and versions \u003c V4.5.0 for CVE-2013-3634), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions \u003c V5.1.0). The user privileges for the web interface are only enforced on client side and not properly verified on server side. Therefore, an attacker is able to execute privileged commands using an unprivileged account.","status":"published","published":"2013-05-24T20:55:01.737Z","modified":"2026-06-16T23:55:32.83Z","cvss":[{"version":"2.0","score":8,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:29.210317Z"}]}}