CVE-2013-4651

MediumCVSS 6.6/10Last modified Jun 16, 2026

Description

Siemens Scalance W7xx devices with firmware before 4.5.4 use the same hardcoded X.509 certificate across different customers' installations, which makes it easier for remote attackers to conduct man-in-the-middle attacks against SSL sessions by leveraging the certificate's trust relationship.

Metrics

CVSS 2.0 6.6/10AV:N/AC:H/Au:N/C:P/I:P/A:C

Weakness enumeration

CWE-255

Affected software

No affected versions have been published.

Timeline

Published
Aug 1, 2013
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2013

CVE-2013-465210.0Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remoteCVE-2013-46534.3Multiple cross-site scripting (XSS) vulnerabilities in the signin functionality of ics in MyTeamwork services in Alcatel-Lucent Omnitouch 86CVE-2013-46549.8Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND..CVE-2013-46557.5Symlink Traversal vulnerability in Belkin N900 due to misconfiguration in the SMB service.CVE-2013-46569.8Symlink Traversal vulnerability in ASUS RT-AC66U and RT-N56U due to misconfiguration in the SMB service.CVE-2013-46579.8Symlink Traversal vulnerability in NETGEAR WNR3500U and WNR3500L due to misconfiguration in the SMB service.CVE-2013-46589.8Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.CVE-2013-46599.8Buffer overflow in Broadcom ACSD allows remote attackers to execute arbitrary code via a long string to TCP port 5916. This component is useCVE-2013-46606.8The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, which allows remote attaCVE-2013-46614.9CiviCRM 2.0.0 through 4.2.9 and 4.3.0 through 4.3.3 does not properly enforce role-based access control (RBAC) restrictions for default custCVE-2013-46626.5The Quick Search API in CiviCRM 4.2.0 through 4.2.9 and 4.3.0 through 4.3.3 allows remote authenticated users to bypass the validation layerCVE-2013-46637.5git_http_controller.rb in the redmine_git_hosting plugin for Redmine allows remote attackers to execute arbitrary commands via shell metacha
CVE-2013-4651: Medium severity, CVSS 6.6 | Vulnix