CVE-2022-26649

CRITICAL

9.6

Description

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices.

CVE Details

CVSS v3.1 Score9.6

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack VectorADJACENT_NETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published7/12/2022

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

siemens:scalance_x200-4p_irtsiemens:scalance_x200-4p_irt_firmwaresiemens:scalance_x201-3p_irtsiemens:scalance_x201-3p_irt_firmwaresiemens:scalance_x201-3p_irt_prosiemens:scalance_x201-3p_irt_pro_firmwaresiemens:scalance_x202-2irtsiemens:scalance_x202-2irt_firmwaresiemens:scalance_x202-2p_irtsiemens:scalance_x202-2p_irt_firmwaresiemens:scalance_x202-2p_irt_prosiemens:scalance_x202-2p_irt_pro_firmwaresiemens:scalance_x204-2siemens:scalance_x204-2_firmwaresiemens:scalance_x204-2fmsiemens:scalance_x204-2fm_firmwaresiemens:scalance_x204-2ldsiemens:scalance_x204-2ld_firmwaresiemens:scalance_x204-2ld_tssiemens:scalance_x204-2ld_ts_firmwaresiemens:scalance_x204-2tssiemens:scalance_x204-2ts_firmwaresiemens:scalance_x204irtsiemens:scalance_x204irt_firmwaresiemens:scalance_x204irt_prosiemens:scalance_x204irt_pro_firmwaresiemens:scalance_x206-1siemens:scalance_x206-1_firmwaresiemens:scalance_x206-1ldsiemens:scalance_x206-1ld_firmwaresiemens:scalance_x208siemens:scalance_x208_firmwaresiemens:scalance_x208_prosiemens:scalance_x208_pro_firmwaresiemens:scalance_x212-2siemens:scalance_x212-2_firmwaresiemens:scalance_x212-2ldsiemens:scalance_x212-2ld_firmwaresiemens:scalance_x216siemens:scalance_x216_firmwaresiemens:scalance_x224siemens:scalance_x224_firmwaresiemens:scalance_xf201-3p_irtsiemens:scalance_xf201-3p_irt_firmwaresiemens:scalance_xf202-2p_irtsiemens:scalance_xf202-2p_irt_firmwaresiemens:scalance_xf204siemens:scalance_xf204-2siemens:scalance_xf204-2_firmwaresiemens:scalance_xf204-2ba_irtsiemens:scalance_xf204-2ba_irt_firmwaresiemens:scalance_xf204_firmwaresiemens:scalance_xf204irtsiemens:scalance_xf204irt_firmwaresiemens:scalance_xf206-1siemens:scalance_xf206-1_firmwaresiemens:scalance_xf208siemens:scalance_xf208_firmware

Weaknesses (CWE)

CWE-120CWE-120

References

https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdf(productcert@siemens.com)

https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdf(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.