The vulnerability of Siemens SCALANCE X industrial switches’ web server allows a hacker to trigger a service failure or execute arbitrary code.

🗓️ 13 Apr 2023 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

Siemens SCALANCE X web server flaw allows POST requests to trigger service failure or execute code.

Reporter	Title	Published	Views	Family All 13
CNNVD	Siemens Web Server缓冲区错误漏洞	13 Apr 202100:00	–	cnnvd
CNVD	Siemens SCALANCE X-200 Web Server Heap Buffer Overflow Vulnerability	13 Apr 202100:00	–	cnvd
CVE	CVE-2021-25668	22 Apr 202120:42	–	cve
Cvelist	CVE-2021-25668	22 Apr 202120:42	–	cvelist
EUVD	EUVD-2021-12560	7 Oct 202500:30	–	euvd
ICS	Siemens Web Server of SCALANCE X200 (Update A)	13 Apr 202100:00	–	ics
NCSC	Vulnerabilities fixed in Siemens products	13 Apr 202100:00	–	ncsc
NCSC	Vulnerabilities fixed in Siemens products.	14 Sep 202100:00	–	ncsc
NVD	CVE-2021-25668	22 Apr 202121:15	–	nvd
OSV	CVE-2021-25668	22 Apr 202121:15	–	osv

Vulners

Node

siemens_ag scalance_x-200_irtRange<5.5.1

OR

siemens_ag scalance_x201-3p_irtRange<5.5.1

OR

siemens_ag scalance_x201-3p_irt_proRange<5.5.1

OR

siemens_ag scalance_x202-2_irtRange<5.5.1

OR

siemens_ag scalance_x202-2p_irt_(incl._siplus_net_variant)Range<5.5.1

OR

siemens_ag scalance_x202-2p_irt_proRange<5.5.1

OR

siemens_ag scalance_x204_irtRange<5.5.1

OR

siemens_ag scalance_x204_irt_proRange<5.5.1

OR

siemens_ag scalance_x204-2_(incl._siplus_net_variant)Range<5.5.1

OR

siemens_ag scalance_x204-2fmRange<5.5.1

OR

siemens_ag scalance_x204-2_(incl._siplus_net_variant)Range<5.2.5

OR

siemens_ag scalance_x204-2fmRange<5.2.5

OR

siemens_ag scalance_x204-2ld_(incl._siplus_net_variant)Range<5.2.5

OR

siemens_ag scalance_x204-2ld_tsRange<5.2.5

OR

siemens_ag scalance_x204-2tsRange<5.2.5

OR

siemens_ag scalance_x206-1Range<5.2.5

OR

siemens_ag scalance_x206-1ldRange<5.2.5

OR

siemens_ag scalance_x208_(incl._siplus_net_variant)Range<5.2.5

OR

siemens_ag scalance_x208proRange<5.2.5

OR

siemens_ag scalance_x212-2_(incl._siplus_net_variant)Range<5.2.5

OR

siemens_ag scalance_x212-2ldRange<5.2.5

OR

siemens_ag scalance_x216Range<5.2.5

OR

siemens_ag scalance_x224Range<5.2.5

OR

siemens_ag scalance_xf201-3p_irtRange<5.5.1

OR

siemens_ag scalance_xf202-2p_irtRange<5.5.1

OR

siemens_ag scalance_xf204Range<5.2.5

OR

siemens_ag scalance_xf204_irtRange<5.5.1

OR

siemens_ag scalance_xf204-2_(incl._siplus_net_variant)Range<5.2.5

OR

siemens_ag scalance_xf204-2ba_irtRange<5.5.1

OR

siemens_ag scalance_xf206-1Range<5.2.5

OR

siemens_ag scalance_xf208Range<5.2.5

Source	Link
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-103-07
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-187092.pdf
web	www.web.nvd.nist.gov/view/vuln/detail
ics-cert	www.ics-cert.us-cert.gov/advisories/ICSA-21-103-07

13 Apr 2023 00:00Current

7.6High risk

Vulners AI Score7.6

CVSS 39.8

CVSS 210

EPSS0.01569

siemens scalance x web server flaw post requests service disruption arbitrary code execution