Multiple vulnerabilities in Siemens SCALANCE X200
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2021-25668 CVE-2021-25669 |
| CWE-ID | CWE-122 CWE-121 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SCALANCE X204-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2FM Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2LD Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2LD TS Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2TS Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X206-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X206-1LD Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X208 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X208PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X212-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X212-2LD Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X216 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X224 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF206-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF208 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X200-4P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X201-3P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X201-3P IRT PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X202-2 IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X202-2P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X202-2P IRT PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204 IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204 IRT PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF201-3P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF202-2P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204 IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204-2BA IRT Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Heap-based buffer overflow
EUVDB-ID: #VU52214
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-25668
CWE-ID:
CWE-122 - Heap-based Buffer Overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSCALANCE X204-2: All versions
SCALANCE X204-2FM: All versions
SCALANCE X204-2LD: All versions
SCALANCE X204-2LD TS: All versions
SCALANCE X204-2TS: All versions
SCALANCE X206-1: All versions
SCALANCE X206-1LD: All versions
SCALANCE X208: All versions
SCALANCE X208PRO: All versions
SCALANCE X212-2: All versions
SCALANCE X212-2LD: All versions
SCALANCE X216: All versions
SCALANCE X224: All versions
SCALANCE XF204: All versions
SCALANCE XF204-2: All versions
SCALANCE XF206-1: All versions
SCALANCE XF208: All versions
SCALANCE X200-4P IRT: before 5.5.1
SCALANCE X201-3P IRT: before 5.5.1
SCALANCE X201-3P IRT PRO: before 5.5.1
SCALANCE X202-2 IRT: before 5.5.1
SCALANCE X202-2P IRT: before 5.5.1
SCALANCE X202-2P IRT PRO: before 5.5.1
SCALANCE X204 IRT: before 5.5.1
SCALANCE X204 IRT PRO: before 5.5.1
SCALANCE XF201-3P IRT: before 5.5.1
SCALANCE XF202-2P IRT: before 5.5.1
SCALANCE XF204 IRT: before 5.5.1
SCALANCE XF204-2BA IRT: before 5.5.1
CPE2.3- cpe:2.3:h:siemens:scalance_x204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2fm:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld_ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x216:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x224:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x200-4p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2ba_irt:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-21-103-07
https://cert-portal.siemens.com/productcert/pdf/ssa-187092.pdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Stack-based buffer overflow
EUVDB-ID: #VU52215
Risk: High
CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2021-25669
CWE-ID:
CWE-121 - Stack-based buffer overflow
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing POST requests in the web server. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSCALANCE X204-2: All versions
SCALANCE X204-2FM: All versions
SCALANCE X204-2LD: All versions
SCALANCE X204-2LD TS: All versions
SCALANCE X204-2TS: All versions
SCALANCE X206-1: All versions
SCALANCE X206-1LD: All versions
SCALANCE X208: All versions
SCALANCE X208PRO: All versions
SCALANCE X212-2: All versions
SCALANCE X212-2LD: All versions
SCALANCE X216: All versions
SCALANCE X224: All versions
SCALANCE XF204: All versions
SCALANCE XF204-2: All versions
SCALANCE XF206-1: All versions
SCALANCE XF208: All versions
SCALANCE X200-4P IRT: before 5.5.1
SCALANCE X201-3P IRT: before 5.5.1
SCALANCE X201-3P IRT PRO: before 5.5.1
SCALANCE X202-2 IRT: before 5.5.1
SCALANCE X202-2P IRT: before 5.5.1
SCALANCE X202-2P IRT PRO: before 5.5.1
SCALANCE X204 IRT: before 5.5.1
SCALANCE X204 IRT PRO: before 5.5.1
SCALANCE XF201-3P IRT: before 5.5.1
SCALANCE XF202-2P IRT: before 5.5.1
SCALANCE XF204 IRT: before 5.5.1
SCALANCE XF204-2BA IRT: before 5.5.1
CPE2.3- cpe:2.3:h:siemens:scalance_x204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2fm:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld_ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x216:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x224:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x200-4p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2ba_irt:*:*:*:*:*:*:*:*
https://ics-cert.us-cert.gov/advisories/icsa-21-103-07
https://cert-portal.siemens.com/productcert/pdf/ssa-187092.pdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
