SB2021011305 - Multiple vulnerabilities in Siemens SCALANCE X-200 and SCALANCE X-200IRT Switches
Published: January 13, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 vulnerabilities.
1) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2020-28391)
CWE-ID: CWE-321 - Use of Hard-coded Cryptographic Key
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to presence of a hard-coded cryptographic key when using the device with C-PLUG. A remote attacker can create a man-in-the-middle situation and decrypt previously captured traffic.
2) Missing Authentication for Critical Function (CVE-ID: CVE-2020-15799)
CWE-ID: CWE-306 - Missing Authentication for Critical Function
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to missing authentication for critical function. A remote attacker can use special URLs from integrated web server of the affected products and reboot the device.
3) Heap-based buffer overflow (CVE-ID: CVE-2020-25226)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error in the web server. A remote attacker can send a specially crafted request, trigger heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.