Multiple vulnerabilities in Siemens SCALANCE X Switch Devices



Published: 2022-07-14 | Updated: 2022-07-14
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2022-26647
CVE-2022-26648
CVE-2022-26649
CWE-ID CWE-330
CWE-119
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
SCALANCE X200-4P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X201-3P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X201-3P IRT PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X202-2IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X202-2P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X202-2P IRT PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204IRT PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF201-3P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF202-2P IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204-2BA IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204IRT
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2FM
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2LD
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2LD TS
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X204-2TS
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X206-1
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X206-1LD
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X208
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X208PRO
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X212-2
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X212-2LD
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X216
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE X224
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF204-2
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF206-1
Hardware solutions / Routers & switches, VoIP, GSM, etc

SCALANCE XF208
Hardware solutions / Routers & switches, VoIP, GSM, etc

Vendor Siemens

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Use of insufficiently random values

EUVDB-ID: #VU65293

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26647

CWE-ID: CWE-330 - Use of Insufficiently Random Values

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the webserver of affected devices calculates session ids and nonces in an insecure manner. A remote attacker can brute-force session ids and hijack existing sessions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SCALANCE X200-4P IRT: All versions

SCALANCE X201-3P IRT: All versions

SCALANCE X201-3P IRT PRO: All versions

SCALANCE X202-2IRT: All versions

SCALANCE X202-2P IRT: All versions

SCALANCE X202-2P IRT PRO: All versions

SCALANCE X204IRT: All versions

SCALANCE X204IRT PRO: All versions

SCALANCE XF201-3P IRT: All versions

SCALANCE XF202-2P IRT: All versions

SCALANCE XF204-2BA IRT: All versions

SCALANCE XF204IRT: All versions

SCALANCE X204-2: before 5.2.6

SCALANCE X204-2FM: before 5.2.6

SCALANCE X204-2LD: before 5.2.6

SCALANCE X204-2LD TS: before 5.2.6

SCALANCE X204-2TS: before 5.2.6

SCALANCE X206-1: before 5.2.6

SCALANCE X206-1LD: before 5.2.6

SCALANCE X208: before 5.2.6

SCALANCE X208PRO: before 5.2.6

SCALANCE X212-2: before 5.2.6

SCALANCE X212-2LD: before 5.2.6

SCALANCE X216: before 5.2.6

SCALANCE X224: before 5.2.6

SCALANCE XF204: before 5.2.6

SCALANCE XF204-2: before 5.2.6

SCALANCE XF206-1: before 5.2.6

SCALANCE XF208: before 5.2.6

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdficsa-22-195-01


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Buffer overflow

EUVDB-ID: #VU65295

Risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26648

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the GET parameter XNo of incoming HTTP requests. A remote user on the local network can trigger memory corruption and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SCALANCE X200-4P IRT: All versions

SCALANCE X201-3P IRT: All versions

SCALANCE X201-3P IRT PRO: All versions

SCALANCE X202-2IRT: All versions

SCALANCE X202-2P IRT: All versions

SCALANCE X202-2P IRT PRO: All versions

SCALANCE X204IRT: All versions

SCALANCE X204IRT PRO: All versions

SCALANCE XF201-3P IRT: All versions

SCALANCE XF202-2P IRT: All versions

SCALANCE XF204-2BA IRT: All versions

SCALANCE XF204IRT: All versions

SCALANCE X204-2: before 5.2.6

SCALANCE X204-2FM: before 5.2.6

SCALANCE X204-2LD: before 5.2.6

SCALANCE X204-2LD TS: before 5.2.6

SCALANCE X204-2TS: before 5.2.6

SCALANCE X206-1: before 5.2.6

SCALANCE X206-1LD: before 5.2.6

SCALANCE X208: before 5.2.6

SCALANCE X208PRO: before 5.2.6

SCALANCE X212-2: before 5.2.6

SCALANCE X212-2LD: before 5.2.6

SCALANCE X216: before 5.2.6

SCALANCE X224: before 5.2.6

SCALANCE XF204: before 5.2.6

SCALANCE XF204-2: before 5.2.6

SCALANCE XF206-1: before 5.2.6

SCALANCE XF208: before 5.2.6

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdficsa-22-195-01


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU65296

Risk: Medium

CVSSv3.1: 8.3 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-26649

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the the URI of incoming HTTP GET requests. A remote attacker on the local network can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SCALANCE X200-4P IRT: All versions

SCALANCE X201-3P IRT: All versions

SCALANCE X201-3P IRT PRO: All versions

SCALANCE X202-2IRT: All versions

SCALANCE X202-2P IRT: All versions

SCALANCE X202-2P IRT PRO: All versions

SCALANCE X204IRT: All versions

SCALANCE X204IRT PRO: All versions

SCALANCE XF201-3P IRT: All versions

SCALANCE XF202-2P IRT: All versions

SCALANCE XF204-2BA IRT: All versions

SCALANCE XF204IRT: All versions

SCALANCE X204-2: before 5.2.6

SCALANCE X204-2FM: before 5.2.6

SCALANCE X204-2LD: before 5.2.6

SCALANCE X204-2LD TS: before 5.2.6

SCALANCE X204-2TS: before 5.2.6

SCALANCE X206-1: before 5.2.6

SCALANCE X206-1LD: before 5.2.6

SCALANCE X208: before 5.2.6

SCALANCE X208PRO: before 5.2.6

SCALANCE X212-2: before 5.2.6

SCALANCE X212-2LD: before 5.2.6

SCALANCE X216: before 5.2.6

SCALANCE X224: before 5.2.6

SCALANCE XF204: before 5.2.6

SCALANCE XF204-2: before 5.2.6

SCALANCE XF206-1: before 5.2.6

SCALANCE XF208: before 5.2.6

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdficsa-22-195-01


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###