ByteOS Network

SCALANCE X224

Source -

CNAADP

CNA CVEs -

ADP CVEs -

CISA CVEs -

NVD CVEs -

12Vulnerabilities found

CVE-2022-40631

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-6.1||MEDIUM

EPSS-0.67% / 71.36%

7 Day CHG~0.00%

Published-11 Oct, 2022 | 00:00

Updated-03 Aug, 2024 | 12:21

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT PRO (All versions < V5.5.0), SCALANCE X202-2IRT (All versions < V5.5.0), SCALANCE X202-2P IRT (All versions < V5.5.0), SCALANCE X202-2P IRT PRO (All versions < V5.5.0), SCALANCE X204-2 (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X204IRT (All versions < V5.5.0), SCALANCE X204IRT PRO (All versions < V5.5.0), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < V5.5.0), SCALANCE XF202-2P IRT (All versions < V5.5.0), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204-2 (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < V5.5.0), SCALANCE XF204IRT (All versions < V5.5.0), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.0). There is a cross-site scripting vulnerability on the affected devices, that if used by a threat actor, it could result in session hijacking.

Vendor-Siemens AG

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2022-26649

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-9.6||CRITICAL

EPSS-1.15% / 78.53%

7 Day CHG~0.00%

Published-12 Jul, 2022 | 10:06

Updated-21 Apr, 2025 | 13:51

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-26648

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-8.2||HIGH

EPSS-0.87% / 75.26%

7 Day CHG~0.00%

Published-12 Jul, 2022 | 10:06

Updated-21 Apr, 2025 | 13:52

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the GET parameter XNo of incoming HTTP requests. This could allow an unauthenticated remote attacker to crash affected devices.

Vendor-Siemens AG

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-26647

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-8.8||HIGH

EPSS-1.48% / 81.05%

7 Day CHG~0.00%

Published-12 Jul, 2022 | 10:06

Updated-21 Apr, 2025 | 13:52

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.

Vendor-Siemens AG

CWE ID-CWE-330

Use of Insufficiently Random Values

CVE-2022-0778

Assigner-OpenSSL Software Foundation

View Details

Assigner-OpenSSL Software Foundation

CVSS Score-7.5||HIGH

EPSS-7.13% / 91.56%

7 Day CHG-0.99%

Published-15 Mar, 2022 | 17:05

Updated-14 Apr, 2026 | 10:16

Infinite loop in BN_mod_sqrt() reachable when parsing certificates

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters. Thus vulnerable situations include: - TLS clients consuming server certificates - TLS servers consuming client certificates - Hosting providers taking certificates or private keys from customers - Certificate authorities parsing certification requests from subscribers - Anything else which parses ASN.1 elliptic curve parameters Also any other applications that use the BN_mod_sqrt() where the attacker can control the parameter values are vulnerable to this DoS issue. In the OpenSSL 1.0.2 version the public key is not parsed during initial parsing of the certificate which makes it slightly harder to trigger the infinite loop. However any operation which requires the public key from the certificate will trigger the infinite loop. In particular the attacker can use a self-signed certificate to trigger the loop during verification of the certificate signature. This issue affects OpenSSL versions 1.0.2, 1.1.1 and 3.0. It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. Fixed in OpenSSL 3.0.2 (Affected 3.0.0,3.0.1). Fixed in OpenSSL 1.1.1n (Affected 1.1.1-1.1.1m). Fixed in OpenSSL 1.0.2zd (Affected 1.0.2-1.0.2zc).

Vendor-Debian GNU/Linux Tenable, Inc.NetApp, Inc.MariaDB Foundation Fedora Project OpenSSL Siemens AG Node.js (OpenJS Foundation)

CWE ID-CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CVE-2021-3712

Assigner-OpenSSL Software Foundation

View Details

Assigner-OpenSSL Software Foundation

CVSS Score-7.4||HIGH

EPSS-0.41% / 61.56%

7 Day CHG~0.00%

Published-24 Aug, 2021 | 14:50

Updated-16 Apr, 2026 | 15:16

Read buffer overruns processing ASN.1 strings

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string data which is terminated with a NUL (0) byte. Although not a strict requirement, ASN.1 strings that are parsed using OpenSSL's own "d2i" functions (and other similar parsing functions) as well as any string whose value has been set with the ASN1_STRING_set() function will additionally NUL terminate the byte array in the ASN1_STRING structure. However, it is possible for applications to directly construct valid ASN1_STRING structures which do not NUL terminate the byte array by directly setting the "data" and "length" fields in the ASN1_STRING array. This can also happen by using the ASN1_STRING_set0() function. Numerous OpenSSL functions that print ASN.1 data have been found to assume that the ASN1_STRING byte array will be NUL terminated, even though this is not guaranteed for strings that have been directly constructed. Where an application requests an ASN.1 structure to be printed, and where that ASN.1 structure contains ASN1_STRINGs that have been directly constructed by the application without NUL terminating the "data" field, then a read buffer overrun can occur. The same thing can also occur during name constraints processing of certificates (for example if a certificate has been directly constructed by the application instead of loading it via the OpenSSL parsing functions, and the certificate contains non NUL terminated ASN1_STRING structures). It can also occur in the X509_get1_email(), X509_REQ_get1_email() and X509_get1_ocsp() functions. If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. This might result in a crash (causing a Denial of Service attack). It could also result in the disclosure of private memory contents (such as private keys, or sensitive plaintext). Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). Fixed in OpenSSL 1.0.2za (Affected 1.0.2-1.0.2y).

Vendor-Oracle Corporation Debian GNU/Linux Tenable, Inc.NetApp, Inc.OpenSSL Siemens AG McAfee, LLC

CWE ID-CWE-125

Out-of-bounds Read

CVE-2020-28400

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-8.7||HIGH

EPSS-1.08% / 77.88%

7 Day CHG~0.00%

Published-13 Jul, 2021 | 11:02

Updated-14 Apr, 2026 | 08:35

Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered if a large amount of DCP reset packets are sent to the device.

Vendor-Siemens AG

CWE ID-CWE-770

Allocation of Resources Without Limits or Throttling

CVE-2021-25669

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.71% / 82.40%

7 Day CHG~0.00%

Published-22 Apr, 2021 | 20:42

Updated-03 Aug, 2024 | 20:11

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT PRO (All versions < 5.5.1), SCALANCE X202-2 IRT (All versions < 5.5.1), SCALANCE X202-2P IRT (incl. SIPLUS NET variant) (All versions < 5.5.1), SCALANCE X202-2P IRT PRO (All versions < 5.5.1), SCALANCE X204 IRT (All versions < 5.5.1), SCALANCE X204 IRT PRO (All versions < 5.5.1), SCALANCE X204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < 5.5.1), SCALANCE XF202-2P IRT (All versions < 5.5.1), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204 IRT (All versions < 5.5.1), SCALANCE XF204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < 5.5.1), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5). Incorrect processing of POST requests in the web server may write out of bounds in stack. An attacker might leverage this to denial-of-service of the device or remote code execution.

Vendor-Siemens AG

CWE ID-CWE-121

Stack-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2021-25668

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-9.8||CRITICAL

EPSS-1.28% / 79.64%

7 Day CHG~0.00%

Published-22 Apr, 2021 | 20:42

Updated-03 Aug, 2024 | 20:11

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT (All versions < 5.5.1), SCALANCE X201-3P IRT PRO (All versions < 5.5.1), SCALANCE X202-2 IRT (All versions < 5.5.1), SCALANCE X202-2P IRT (incl. SIPLUS NET variant) (All versions < 5.5.1), SCALANCE X202-2P IRT PRO (All versions < 5.5.1), SCALANCE X204 IRT (All versions < 5.5.1), SCALANCE X204 IRT PRO (All versions < 5.5.1), SCALANCE X204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < 5.5.1), SCALANCE XF202-2P IRT (All versions < 5.5.1), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204 IRT (All versions < 5.5.1), SCALANCE XF204-2 (incl. SIPLUS NET variant) (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < 5.5.1), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5). Incorrect processing of POST requests in the webserver may result in write out of bounds in heap. An attacker might leverage this to cause denial-of-service on the device and potentially remotely execute code.

Vendor-Siemens AG

CWE ID-CWE-122

Heap-based Buffer Overflow

CWE ID-CWE-787

Out-of-bounds Write

CVE-2019-19301

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-7.5||HIGH

EPSS-0.54% / 67.54%

7 Day CHG-0.00%

Published-14 Apr, 2020 | 19:50

Updated-05 Aug, 2024 | 02:16

A vulnerability has been identified in SCALANCE X200-4P IRT, SCALANCE X201-3P IRT, SCALANCE X201-3P IRT PRO, SCALANCE X202-2IRT, SCALANCE X202-2P IRT, SCALANCE X202-2P IRT PRO, SCALANCE X204-2, SCALANCE X204-2FM, SCALANCE X204-2LD, SCALANCE X204-2LD TS, SCALANCE X204-2TS, SCALANCE X204IRT, SCALANCE X204IRT PRO, SCALANCE X206-1, SCALANCE X206-1LD, SCALANCE X208, SCALANCE X208PRO, SCALANCE X212-2, SCALANCE X212-2LD, SCALANCE X216, SCALANCE X224, SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XF201-3P IRT, SCALANCE XF202-2P IRT, SCALANCE XF204, SCALANCE XF204-2, SCALANCE XF204-2BA IRT, SCALANCE XF204IRT, SCALANCE XF206-1, SCALANCE XF208, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIMATIC CP 343-1 Advanced, SIMATIC CP 442-1 RNA, SIMATIC CP 443-1, SIMATIC CP 443-1, SIMATIC CP 443-1 Advanced, SIMATIC CP 443-1 RNA, SIMATIC RF180C, SIMATIC RF182C, SIPLUS NET CP 343-1 Advanced, SIPLUS NET CP 443-1, SIPLUS NET CP 443-1 Advanced, SIPLUS NET SCALANCE X308-2. The VxWorks-based Profinet TCP Stack can be forced to make very expensive calls for every incoming packet which can lead to a denial of service.

Vendor-Siemens AG

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2019-13946

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-7.5||HIGH

EPSS-0.55% / 68.06%

7 Day CHG~0.00%

Published-11 Feb, 2020 | 15:36

Updated-05 Aug, 2024 | 00:05

Profinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package requests are sent to the DCE-RPC interface. This could lead to a denial of service condition due to lack of memory for devices that include a vulnerable version of the stack. The security vulnerability could be exploited by an attacker with network access to an affected device. Successful exploitation requires no system privileges and no user interaction. An attacker could use the vulnerability to compromise the availability of the device.

Vendor-Siemens AG

Product-simatic_et200al_im_157-1_pn_firmware simatic_rf182c scalance_xr526 simatic_et200m_im153-4_pn_io_hf_firmware scalance_xr552_firmware simatic_et200mp_im155-5_pn_st_firmware scalance_xr552 simatic_cp_1616 ruggedcom_rm1224_firmware simatic_cp_1604 simatic_et200sp_im155-6_pn_hf dk_standard_ethernet_controller scalance_xr-300wg scalance_xp-200 simatic_et200mp_im155-5_pn_hf_firmware scalance_xf-200ba simatic_ipc_support scalance_x-400_firmware scalance_x-300 scalance_x-200irt simatic_cp_443-1 simatic_cp_343-1_erpc scalance_xf-200_firmware scalance_xf-200 simatic_et200sp_im155-6_pn_basic simatic_et200sp_im155-6_pn_hf_firmware scalance_s615_firmware simatic_cp_1616_firmware scalance_xr524_firmware scalance_w700_ieee_802.11n_firmware scalance_m-800_firmware simatic_et200m_im153-4_pn_io_st_firmware simatic_cp_443-1_advanced_firmware scalance_xc-200_firmware profinet_driver simatic_cp_343-1 simatic_et200al_im_157-1_pn im_154-3_pn_hf simatic_cp_343-1_lean_firmware simatic_mv420_firmware scalance_xr-300wg_firmware simatic_mv420 im_154-4_pn_hf simatic_et200ecopn scalance_x-200irt_firmware simatic_et200s_firmware scalance_xr526_firmware scalance_x-300_firmware ek-ertec_200 scalance_xr524 simatic_rf600 simatic_cp_443-1_opc_ua ek-ertec_200_firmware sinamics_dcp_firmware simatic_cp_443-1_advanced simatic_mv440 simatic_cp_343-1_firmware scalance_xm-400 simatic_et200pro_firmware simatic_cp_343-1_lean scalance_xf-200ba_firmware simatic_et200ecopn_firmware ek-ertec_200p_firmware scalance_xr528_firmware scalance_xr528 simatic_rf180c simatic_mv440_firmware ruggedcom_rm1224 scalance_x-400 simatic_cp_1604_firmware scalance_s615 im_154-4_pn_hf_firmware simatic_cp_343-1_advanced_firmware simatic_cp_443-1_opc_ua_firmware simatic_rf600_firmware scalance_w700_ieee_802.11n simatic_pn\/pn_coupler_firmware simatic_et200m_im153-4_pn_io_st ek-ertec_200p sinamics_dcp simatic_et200s simatic_rf182c_firmware scalance_xp-200_firmware simatic_et200sp_im155-6_pn_basic_firmware simatic_et200mp_im155-5_pn_st simatic_cp_443-1_firmware scalance_xb-200 simatic_et200sp_im155-6_pn_st_firmware im_154-3_pn_hf_firmware scalance_xm-400_firmware simatic_cp_343-1_erpc_firmware simatic_et200pro scalance_xb-200_firmware simatic_pn\/pn_coupler simatic_et200sp_im155-6_pn_st simatic_et200mp_im155-5_pn_hf scalance_xc-200 simatic_rf180c_firmware simatic_cp_343-1_advanced scalance_m-800 simatic_et200m_im153-4_pn_io_hf SCALANCE XF208 SIMOTION D SCALANCE XR324-4M EEC (24V, ports on front)SCALANCE X204IRT SCALANCE X307-2 EEC (2x 24V, coated)SIMATIC PN/PN Coupler (incl. SIPLUS NET variants)SIMOTION P SCALANCE XB-200 family SCALANCE X204-2TS SCALANCE X307-3 SCALANCE XR324-12M (24V, ports on rear)SCALANCE X308-2 SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL SCALANCE X307-2 EEC (230V, coated)SIMATIC RF180C SIMATIC MV440 HR SIPLUS NET SCALANCE X308-2 SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)SIMATIC ET200ecoPN: IO-Link Master SCALANCE X202-2P IRT SCALANCE XR324-4M PoE (230V, ports on rear)SCALANCE X302-7 EEC (230V)SIMATIC CP 443-1 SOFTNET-IE PNIO SCALANCE S615 LAN-Router SCALANCE X206-1LD SIMATIC CP 343-1 Advanced SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12 SIMATIC ET 200M IM 153-4 PN IO HF (incl. SIPLUS variants)SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL SCALANCE W-700 IEEE 802.11n family SIPLUS ET 200SP IM 155-6 PN ST TX RAIL SIMATIC MV420 SR-B SCALANCE XR-500 family SINAMICS DCP SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12 SCALANCE XF204IRT SCALANCE X307-2 EEC (2x 230V)SIMATIC ET 200MP IM 155-5 PN ST SCALANCE M826-2 SHDSL-Router SCALANCE XF-200BA SCALANCE X204IRT PRO SIMATIC MV420 SR-P SCALANCE XP-200 SIMATIC RF182C SIPLUS NET CP 443-1 SIMOTION C SCALANCE X201-3P IRT SCALANCE M804PB SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12 Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P SIPLUS ET 200SP IM 155-6 PN ST BA SIMATIC ET 200pro IM 154-3 PN HF SCALANCE X206-1 SCALANCE XF204 SIMATIC MV420 SR-B Body Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200 SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12 SIMATIC IPC Support, Package for VxWorks SCALANCE X308-2LH SCALANCE XF204-2 SCALANCE XR324-4M EEC (24V, ports on rear)SCALANCE XR324-4M PoE (24V, ports on front)SCALANCE XM-400 family SCALANCE X302-7 EEC (2x 230V)SCALANCE X408-2 SCALANCE XF201-3P IRT SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12 SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL SIMATIC MV420 SR-P Body SCALANCE M816-1 ADSL-Router SIMATIC MV440 SR SCALANCE M812-1 ADSL-Router SCALANCE X307-2 EEC (2x 24V)SCALANCE X212-2 SCALANCE X306-1LD FE SCALANCE X308-2M TS SCALANCE M876-3 SIMATIC ET 200AL IM 157-1 PN SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12 SIPLUS ET 200MP IM 155-5 PN ST TX RAIL SCALANCE X201-3P IRT PRO SCALANCE X302-7 EEC (2x 230V, coated)SCALANCE X320-1-2LD FE SCALANCE XR324-4M PoE TS (24V, ports on front)SCALANCE XR324-12M TS (24V)SCALANCE XR324-12M (230V, ports on rear)SCALANCE XF204-2BA IRT SCALANCE X204-2FM SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12 SIMATIC CP 443-1 OPC UA SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)SIMATIC ET200ecoPN, 4AO U/I 4xM12 SCALANCE X204-2LD TS SIMATIC ET 200SP IM 155-6 PN HF SCALANCE X302-7 EEC (24V, coated)SIMATIC CP 443-1 Advanced SCALANCE XR-300WG family SCALANCE X224 SIMATIC ET 200SP IM 155-6 PN ST SIPLUS ET 200SP IM 155-6 PN HF PROFINET Driver for Controller SIMATIC RF600R family SCALANCE M876-4 (NAM)SCALANCE M874-3 SCALANCE X308-2LD SCALANCE X307-2 EEC (24V)SIMATIC ET 200SP IM 155-6 PN BA SCALANCE X208 SCALANCE M876-3 (ROK)SCALANCE X304-2FE SCALANCE X307-2 EEC (230V)SIPLUS NET CP 343-1 Lean SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)SIMATIC ET 200SP IM 155-6 PN ST BA SCALANCE X302-7 EEC (2x 24V)SIMATIC ET 200MP IM 155-5 PN HF RUGGEDCOM RM1224 family SIMATIC ET 200pro IM 154-4 PN HF SCALANCE X208PRO SIPLUS NET CP 343-1 SCALANCE X212-2LD SCALANCE X302-7 EEC (24V)SCALANCE X204-2 SCALANCE XF206-1 SIMATIC ET200S (incl. SIPLUS variants)SIMATIC CP 343-1 Lean SCALANCE XR324-4M EEC (2x 24V, ports on rear)SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12 SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)SCALANCE XR324-4M PoE (24V, ports on rear)SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12 SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12 SCALANCE X204-2LD SCALANCE M876-4 (EU)SIMATIC ET 200M IM 153-4 PN IO ST (incl. SIPLUS variants)SCALANCE X308-2M SCALANCE X308-2M PoE SCALANCE X310FE SCALANCE X308-2LH+SIPLUS NET CP 343-1 Advanced SIMATIC CP 343-1 SCALANCE X307-3LD Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12 SIPLUS NET CP 443-1 Advanced SCALANCE XF202-2P IRT SCALANCE X307-2 EEC (24V, coated)SCALANCE X307-2 EEC (2x 230V, coated)SCALANCE X302-7 EEC (2x 24V, coated)SCALANCE X202-2P IRT PRO SCALANCE X310 SCALANCE XR324-12M (24V, ports on front)SIPLUS ET 200MP IM 155-5 PN ST SCALANCE X320-1 FE SCALANCE M874-2 SCALANCE XR324-4M PoE (230V, ports on front)SIMATIC CP 343-1 ERPC SIPLUS ET 200SP IM 155-6 PN ST SIMATIC MV440 UR SCALANCE X216 SIMATIC CP 1616 and CP 1604 SCALANCE X302-7 EEC (230V, coated)SIPLUS ET 200MP IM 155-5 PN HF SCALANCE X200-4P IRT SCALANCE XC-200 SCALANCE X202-2IRT SCALANCE XR324-12M (230V, ports on front)SCALANCE XR324-4M EEC (2x 24V, ports on front)

CWE ID-CWE-400

Uncontrolled Resource Consumption

CVE-2019-6569

Assigner-Siemens

View Details

Assigner-Siemens

CVSS Score-9.1||CRITICAL

EPSS-0.51% / 66.33%

7 Day CHG+0.03%

Published-26 Mar, 2019 | 21:12

Updated-04 Aug, 2024 | 20:23

The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.

Vendor-Siemens AG

Product-scalance_x-200_firmware scalance_x-200 scalance_xp-200_firmware scalance_x-300 scalance_xc-200_firmware scalance_x-300_firmware scalance_xc-200 scalance_xf-200_firmware scalance_xf-200 scalance_xp-200 SCALANCE XF208 SCALANCE XR324-12M TS (24V)SCALANCE XR324-4M EEC (24V, ports on front)SCALANCE XR324-12M (230V, ports on rear)SCALANCE XR328-4C WG (28xGE, AC 230V)SCALANCE X307-2 EEC (2x 24V, coated)SCALANCE XP208 SCALANCE XF204 DNA SCALANCE X204-2FM SCALANCE X204-2TS SCALANCE X307-3 SCALANCE XR324-12M (24V, ports on rear)SCALANCE X308-2 SCALANCE XB205-3 (ST/BFOC)SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front)SCALANCE X204-2LD TS SCALANCE XC208G SCALANCE XR328-4C WG (24XFE, 4XGE, 24V)SCALANCE XP208PoE EEC SCALANCE X302-7 EEC (24V, coated)SCALANCE X307-2 EEC (230V, coated)SCALANCE X224 SIPLUS NET SCALANCE X308-2 SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front)SCALANCE XC216EEC SCALANCE XR324WG (24 X FE, DC 24V)SCALANCE XR324-4M PoE (230V, ports on rear)SCALANCE X302-7 EEC (230V)SIPLUS NET SCALANCE XC208 SCALANCE XC216-4C G (EIP Def.)SCALANCE XR328-4C WG (24xFE,4xGE,AC230V)SCALANCE XP208EEC SCALANCE X206-1LD SCALANCE XR324WG (24 x FE, AC 230V)SCALANCE X308-2LD SCALANCE X307-2 EEC (24V)SCALANCE XF204-2BA SCALANCE X208 SCALANCE X304-2FE SCALANCE XC224-4C G (EIP Def.)SCALANCE XC208EEC SCALANCE X307-2 EEC (230V)SIPLUS NET SCALANCE XC206-2 SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear)SCALANCE XB216 SCALANCE XP216 SCALANCE X302-7 EEC (2x 24V)SCALANCE XP216EEC SCALANCE XC206-2SFP G EEC SCALANCE X307-2 EEC (2x 230V)SCALANCE XC208 SCALANCE X208PRO SCALANCE XF204-2BA DNA SCALANCE X212-2LD SCALANCE XC216-4C G SCALANCE XC224 SCALANCE X302-7 EEC (24V)SCALANCE X204-2 SCALANCE XF206-1 SCALANCE XR324-4M EEC (2x 24V, ports on rear)SIPLUS NET SCALANCE XC206-2SFP SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear)SCALANCE XR324-4M PoE (24V, ports on rear)SCALANCE X204-2LD SCALANCE XC224-4C G SCALANCE X308-2M SCALANCE XC206-2 (ST/BFOC)SCALANCE XB213-3LD SCALANCE XC224-4C G EEC SCALANCE X308-2M PoE SCALANCE X310FE SCALANCE X308-2LH+SCALANCE X206-1 SCALANCE XF204 SCALANCE XP216POE EEC SCALANCE XB208 SCALANCE X307-3LD SCALANCE X308-2LH SCALANCE XF204-2 SCALANCE XR324-4M EEC (24V, ports on rear)SCALANCE XR324-4M PoE (24V, ports on front)SCALANCE X302-7 EEC (2x 230V)SCALANCE X408-2 SCALANCE XC206-2SFP SCALANCE XB205-3LD SCALANCE X307-2 EEC (24V, coated)SCALANCE X307-2 EEC (2x 230V, coated)SCALANCE X302-7 EEC (2x 24V, coated)SCALANCE XR328-4C WG (24xFE, 4xGE,DC24V)SCALANCE XB213-3 (ST/BFOC)SCALANCE X310 SCALANCE X307-2 EEC (2x 24V)SCALANCE XC206-2 (SC)SCALANCE XR324-12M (24V, ports on front)SCALANCE XB205-3 (SC)SCALANCE X212-2 SCALANCE X320-1 FE SCALANCE XC206-2SFP G SCALANCE XC206-2SFP EEC SCALANCE X306-1LD FE SCALANCE X308-2M TS SCALANCE XR324-4M PoE (230V, ports on front)SCALANCE XC216-4C SCALANCE XC216-4C G EEC SCALANCE X216 SCALANCE XC216 SCALANCE X302-7 EEC (230V, coated)SIPLUS NET SCALANCE XC216-4C SCALANCE X302-7 EEC (2x 230V, coated)SCALANCE XB213-3 (SC)SCALANCE X320-1-2LD FE SCALANCE XR324-4M PoE TS (24V, ports on front)SCALANCE XR324-12M (230V, ports on front)SCALANCE XC208G EEC SCALANCE XR328-4C WG (28xGE, DC 24V)SCALANCE XR324-4M EEC (2x 24V, ports on front)

CWE ID-CWE-440

Expected Behavior Violation