Multiple vulnerabilities in Siemens SCALANCE X Switch Devices
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2022-26647 CVE-2022-26648 CVE-2022-26649 |
| CWE-ID | CWE-330 CWE-119 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
SCALANCE X200-4P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X201-3P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X201-3P IRT PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X202-2IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X202-2P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X202-2P IRT PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204IRT PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF201-3P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF202-2P IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204-2BA IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204IRT Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2FM Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2LD Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2LD TS Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X204-2TS Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X206-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X206-1LD Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X208 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X208PRO Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X212-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X212-2LD Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X216 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE X224 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF204-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF206-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE XF208 Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Use of insufficiently random values
EUVDB-ID: #VU65293
Risk: High
CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-26647
CWE-ID:
CWE-330 - Use of Insufficiently Random Values
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the webserver of affected devices calculates session ids and nonces in an insecure manner. A remote attacker can brute-force session ids and hijack existing sessions.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSCALANCE X200-4P IRT: All versions
SCALANCE X201-3P IRT: All versions
SCALANCE X201-3P IRT PRO: All versions
SCALANCE X202-2IRT: All versions
SCALANCE X202-2P IRT: All versions
SCALANCE X202-2P IRT PRO: All versions
SCALANCE X204IRT: All versions
SCALANCE X204IRT PRO: All versions
SCALANCE XF201-3P IRT: All versions
SCALANCE XF202-2P IRT: All versions
SCALANCE XF204-2BA IRT: All versions
SCALANCE XF204IRT: All versions
SCALANCE X204-2: before 5.2.6
SCALANCE X204-2FM: before 5.2.6
SCALANCE X204-2LD: before 5.2.6
SCALANCE X204-2LD TS: before 5.2.6
SCALANCE X204-2TS: before 5.2.6
SCALANCE X206-1: before 5.2.6
SCALANCE X206-1LD: before 5.2.6
SCALANCE X208: before 5.2.6
SCALANCE X208PRO: before 5.2.6
SCALANCE X212-2: before 5.2.6
SCALANCE X212-2LD: before 5.2.6
SCALANCE X216: before 5.2.6
SCALANCE X224: before 5.2.6
SCALANCE XF204: before 5.2.6
SCALANCE XF204-2: before 5.2.6
SCALANCE XF206-1: before 5.2.6
SCALANCE XF208: before 5.2.6
CPE2.3- cpe:2.3:h:siemens:scalance_x200-4p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2ba_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2fm:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld_ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x216:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x224:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf208:*:*:*:*:*:*:*:*
https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdficsa-22-195-01
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Buffer overflow
EUVDB-ID: #VU65295
Risk: Low
CVSSv4.0: 4.6 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-26648
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a boundary error within the GET parameter XNo of incoming HTTP requests. A remote user on the local network can trigger memory corruption and cause a denial of service condition on the target system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSCALANCE X200-4P IRT: All versions
SCALANCE X201-3P IRT: All versions
SCALANCE X201-3P IRT PRO: All versions
SCALANCE X202-2IRT: All versions
SCALANCE X202-2P IRT: All versions
SCALANCE X202-2P IRT PRO: All versions
SCALANCE X204IRT: All versions
SCALANCE X204IRT PRO: All versions
SCALANCE XF201-3P IRT: All versions
SCALANCE XF202-2P IRT: All versions
SCALANCE XF204-2BA IRT: All versions
SCALANCE XF204IRT: All versions
SCALANCE X204-2: before 5.2.6
SCALANCE X204-2FM: before 5.2.6
SCALANCE X204-2LD: before 5.2.6
SCALANCE X204-2LD TS: before 5.2.6
SCALANCE X204-2TS: before 5.2.6
SCALANCE X206-1: before 5.2.6
SCALANCE X206-1LD: before 5.2.6
SCALANCE X208: before 5.2.6
SCALANCE X208PRO: before 5.2.6
SCALANCE X212-2: before 5.2.6
SCALANCE X212-2LD: before 5.2.6
SCALANCE X216: before 5.2.6
SCALANCE X224: before 5.2.6
SCALANCE XF204: before 5.2.6
SCALANCE XF204-2: before 5.2.6
SCALANCE XF206-1: before 5.2.6
SCALANCE XF208: before 5.2.6
CPE2.3- cpe:2.3:h:siemens:scalance_x200-4p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2ba_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2fm:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld_ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x216:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x224:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf208:*:*:*:*:*:*:*:*
https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdficsa-22-195-01
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Buffer overflow
EUVDB-ID: #VU65296
Risk: Medium
CVSSv4.0: 6.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-26649
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the the URI of incoming HTTP GET requests. A remote attacker on the local network can trigger memory corruption and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSCALANCE X200-4P IRT: All versions
SCALANCE X201-3P IRT: All versions
SCALANCE X201-3P IRT PRO: All versions
SCALANCE X202-2IRT: All versions
SCALANCE X202-2P IRT: All versions
SCALANCE X202-2P IRT PRO: All versions
SCALANCE X204IRT: All versions
SCALANCE X204IRT PRO: All versions
SCALANCE XF201-3P IRT: All versions
SCALANCE XF202-2P IRT: All versions
SCALANCE XF204-2BA IRT: All versions
SCALANCE XF204IRT: All versions
SCALANCE X204-2: before 5.2.6
SCALANCE X204-2FM: before 5.2.6
SCALANCE X204-2LD: before 5.2.6
SCALANCE X204-2LD TS: before 5.2.6
SCALANCE X204-2TS: before 5.2.6
SCALANCE X206-1: before 5.2.6
SCALANCE X206-1LD: before 5.2.6
SCALANCE X208: before 5.2.6
SCALANCE X208PRO: before 5.2.6
SCALANCE X212-2: before 5.2.6
SCALANCE X212-2LD: before 5.2.6
SCALANCE X216: before 5.2.6
SCALANCE X224: before 5.2.6
SCALANCE XF204: before 5.2.6
SCALANCE XF204-2: before 5.2.6
SCALANCE XF206-1: before 5.2.6
SCALANCE XF208: before 5.2.6
CPE2.3- cpe:2.3:h:siemens:scalance_x200-4p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x201-3p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x202-2p_irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204irt_pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf201-3p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf202-2p_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2ba_irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204irt:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2fm:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ld_ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x204-2ts:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x206-1ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x208pro:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x212-2ld:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x216:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_x224:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf204-2:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf206-1:*:*:*:*:*:*:*:*
- cpe:2.3:h:siemens:scalance_xf208:*:*:*:*:*:*:*:*
https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdficsa-22-195-01
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
