Lucene search

[email protected]NVD:CVE-2022-25751

HistoryApr 12, 2022 - 9:15 a.m.

CVE-2022-25751

2022-04-1209:15:14

CWE-20

[email protected]

web.nvd.nist.gov

vulnerability

scalance devices

unauthenticated remote attacker

crash

improper validation

http headers

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

56.0%

JSON

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. Affected devices do not properly validate the HTTP headers of incoming requests. This could allow an unauthenticated remote attacker to crash affected devices.

Affected configurations

Nvd

Node

siemensscalance_x302-7eec_firmwareRange<4.1.4

AND

siemensscalance_x302-7eecMatch-

Node

siemensscalance_x304-2fe_firmwareRange<4.1.4

AND

siemensscalance_x304-2feMatch-

Node

siemensscalance_x306-1ldfe_firmwareRange<4.1.4

AND

siemensscalance_x306-1ldfeMatch-

Node

siemensscalance_x307-2eec_firmwareRange<4.1.4

AND

siemensscalance_x307-2eecMatch-

Node

siemensscalance_x307-3_firmwareRange<4.1.4

AND

siemensscalance_x307-3Match-

Node

siemensscalance_x307-3ld_firmwareRange<4.1.4

AND

siemensscalance_x307-3ldMatch-

Node

siemensscalance_x308-2_firmwareRange<4.1.4

AND

siemensscalance_x308-2Match-

Node

siemensscalance_x308-2ld_firmwareRange<4.1.4

AND

siemensscalance_x308-2ldMatch-

Node

siemensscalance_x308-2lh_firmwareRange<4.1.4

AND

siemensscalance_x308-2lhMatch-

Node

siemensscalance_x308-2lh\+_firmwareRange<4.1.4

AND

siemensscalance_x308-2lh\+Match-

Node

siemensscalance_x308-2m_firmwareRange<4.1.4

AND

siemensscalance_x308-2mMatch-

Node

siemensscalance_x308-2m_poe_firmwareMatch-

AND

siemensscalance_x308-2m_poeMatch-

Node

siemensscalance_x308-2m_ts_firmwareRange<4.1.4

AND

siemensscalance_x308-2m_tsMatch-

Node

siemensscalance_x310_firmwareRange<4.1.4

AND

siemensscalance_x310Match-

Node

siemensscalance_x310fe_firmwareRange<4.1.4

AND

siemensscalance_x310feMatch-

Node

siemensscalance_x320-1fe_firmwareRange<4.1.4

AND

siemensscalance_x320-1feMatch-

Node

siemensscalance_x320-1-2ldfe_firmwareRange<4.1.4

AND

siemensscalance_x320-1-2ldfeMatch-

Node

siemensscalance_x408-2_firmwareRange<4.1.4

AND

siemensscalance_x408-2Match-

Node

siemensscalance_xr324-4m_eec_firmwareRange<4.1.4

AND

siemensscalance_xr324-4m_eecMatch-

Node

siemensscalance_xr324-4m_poe_firmwareRange<4.1.4

AND

siemensscalance_xr324-4m_poeMatch-

Node

siemensscalance_xr324-4m_poe_ts_firmwareRange<4.1.4

AND

siemensscalance_xr324-4m_poe_tsMatch-

Node

siemensscalance_xr324-12m_firmwareRange<4.1.4

AND

siemensscalance_xr324-12mMatch-

Node

siemensscalance_xr324-12m_ts_firmwareRange<4.1.4

AND

siemensscalance_xr324-12m_tsMatch-

Node

siemenssiplus_net_scalance_x308-2_firmwareRange<4.1.4

AND

siemenssiplus_net_scalance_x308-2Match-

VendorProductVersionCPE
siemensscalance_x302-7eec_firmware*cpe:2.3:o:siemens:scalance_x302-7eec_firmware:*:*:*:*:*:*:*:*
siemensscalance_x302-7eec-cpe:2.3:h:siemens:scalance_x302-7eec:-:*:*:*:*:*:*:*
siemensscalance_x304-2fe_firmware*cpe:2.3:o:siemens:scalance_x304-2fe_firmware:*:*:*:*:*:*:*:*
siemensscalance_x304-2fe-cpe:2.3:h:siemens:scalance_x304-2fe:-:*:*:*:*:*:*:*
siemensscalance_x306-1ldfe_firmware*cpe:2.3:o:siemens:scalance_x306-1ldfe_firmware:*:*:*:*:*:*:*:*
siemensscalance_x306-1ldfe-cpe:2.3:h:siemens:scalance_x306-1ldfe:-:*:*:*:*:*:*:*
siemensscalance_x307-2eec_firmware*cpe:2.3:o:siemens:scalance_x307-2eec_firmware:*:*:*:*:*:*:*:*
siemensscalance_x307-2eec-cpe:2.3:h:siemens:scalance_x307-2eec:-:*:*:*:*:*:*:*
siemensscalance_x307-3_firmware*cpe:2.3:o:siemens:scalance_x307-3_firmware:*:*:*:*:*:*:*:*
siemensscalance_x307-3-cpe:2.3:h:siemens:scalance_x307-3:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	scalance_x302-7eec_firmware	*	cpe:2.3:o:siemens:scalance_x302-7eec_firmware::::::::
siemens	scalance_x302-7eec	-	cpe:2.3:h:siemens:scalance_x302-7eec:-:::::::*
siemens	scalance_x304-2fe_firmware	*	cpe:2.3:o:siemens:scalance_x304-2fe_firmware::::::::
siemens	scalance_x304-2fe	-	cpe:2.3:h:siemens:scalance_x304-2fe:-:::::::*
siemens	scalance_x306-1ldfe_firmware	*	cpe:2.3:o:siemens:scalance_x306-1ldfe_firmware::::::::
siemens	scalance_x306-1ldfe	-	cpe:2.3:h:siemens:scalance_x306-1ldfe:-:::::::*
siemens	scalance_x307-2eec_firmware	*	cpe:2.3:o:siemens:scalance_x307-2eec_firmware::::::::
siemens	scalance_x307-2eec	-	cpe:2.3:h:siemens:scalance_x307-2eec:-:::::::*
siemens	scalance_x307-3_firmware	*	cpe:2.3:o:siemens:scalance_x307-3_firmware::::::::
siemens	scalance_x307-3	-	cpe:2.3:h:siemens:scalance_x307-3:-:::::::*

Rows per page:

1-10 of 481

References

cert-portal.siemens.com/productcert/pdf/ssa-836527.pdf

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.002

Percentile

56.0%

JSON

Related for NVD:CVE-2022-25751

cvelist1 prion1 nessus1 cve1 ics1