Multiple vulnerabilities in Siemens SCALANCE X200



Published: 2021-04-14
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2021-25668
CVE-2021-25669
CWE-ID CWE-122
CWE-121
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
SCALANCE X204-2
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2FM
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2LD
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2LD TS
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2TS
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X206-1
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X206-1LD
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X208
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X208PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X212-2
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X212-2LD
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X216
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X224
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204-2
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF206-1
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF208
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X200-4P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X201-3P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X201-3P IRT PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X202-2 IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X202-2P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X202-2P IRT PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204 IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204 IRT PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF201-3P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF202-2P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204 IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204-2BA IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Siemens

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Heap-based buffer overflow

EUVDB-ID: #VU52214

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-25668

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error. A remote attacker can pass specially crafted data to the application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SCALANCE X204-2: All versions

SCALANCE X204-2FM: All versions

SCALANCE X204-2LD: All versions

SCALANCE X204-2LD TS: All versions

SCALANCE X204-2TS: All versions

SCALANCE X206-1: All versions

SCALANCE X206-1LD: All versions

SCALANCE X208: All versions

SCALANCE X208PRO: All versions

SCALANCE X212-2: All versions

SCALANCE X212-2LD: All versions

SCALANCE X216: All versions

SCALANCE X224: All versions

SCALANCE XF204: All versions

SCALANCE XF204-2: All versions

SCALANCE XF206-1: All versions

SCALANCE XF208: All versions

SCALANCE X200-4P IRT: before 5.5.1

SCALANCE X201-3P IRT: before 5.5.1

SCALANCE X201-3P IRT PRO: before 5.5.1

SCALANCE X202-2 IRT: before 5.5.1

SCALANCE X202-2P IRT: before 5.5.1

SCALANCE X202-2P IRT PRO: before 5.5.1

SCALANCE X204 IRT: before 5.5.1

SCALANCE X204 IRT PRO: before 5.5.1

SCALANCE XF201-3P IRT: before 5.5.1

SCALANCE XF202-2P IRT: before 5.5.1

SCALANCE XF204 IRT: before 5.5.1

SCALANCE XF204-2BA IRT: before 5.5.1

External links

http://ics-cert.us-cert.gov/advisories/icsa-21-103-07
http://cert-portal.siemens.com/productcert/pdf/ssa-187092.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Stack-based buffer overflow

EUVDB-ID: #VU52215

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-25669

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing POST requests in the web server. A remote unauthenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SCALANCE X204-2: All versions

SCALANCE X204-2FM: All versions

SCALANCE X204-2LD: All versions

SCALANCE X204-2LD TS: All versions

SCALANCE X204-2TS: All versions

SCALANCE X206-1: All versions

SCALANCE X206-1LD: All versions

SCALANCE X208: All versions

SCALANCE X208PRO: All versions

SCALANCE X212-2: All versions

SCALANCE X212-2LD: All versions

SCALANCE X216: All versions

SCALANCE X224: All versions

SCALANCE XF204: All versions

SCALANCE XF204-2: All versions

SCALANCE XF206-1: All versions

SCALANCE XF208: All versions

SCALANCE X200-4P IRT: before 5.5.1

SCALANCE X201-3P IRT: before 5.5.1

SCALANCE X201-3P IRT PRO: before 5.5.1

SCALANCE X202-2 IRT: before 5.5.1

SCALANCE X202-2P IRT: before 5.5.1

SCALANCE X202-2P IRT PRO: before 5.5.1

SCALANCE X204 IRT: before 5.5.1

SCALANCE X204 IRT PRO: before 5.5.1

SCALANCE XF201-3P IRT: before 5.5.1

SCALANCE XF202-2P IRT: before 5.5.1

SCALANCE XF204 IRT: before 5.5.1

SCALANCE XF204-2BA IRT: before 5.5.1

External links

http://ics-cert.us-cert.gov/advisories/icsa-21-103-07
http://cert-portal.siemens.com/productcert/pdf/ssa-187092.pdf


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###