CVE-2022-27481

CVE-2022-27481 affects Siemens SCALANCE W1788-1 M12, W1788-2 EEC M12, W1788-2 M12, and W1788-2IA M12 (all versions before 3.0.0). The vulnerability arises from improper handling of ARP request resources, enabling a race condition that can crash the entire device. Attached Red Hat/CISA/ICS and oth...

CVE-2022-27481

A vulnerability has been identified in SCALANCE W1788-1 M12 All versions V3.0.0, SCALANCE W1788-2 EEC M12 All versions V3.0.0, SCALANCE W1788-2 M12 All versions V3.0.0, SCALANCE W1788-2IA M12 All versions V3.0.0. Affected devices do not properly handle resources of ARP requests. This could allow ...

CVE-2022-26380

CVE-2022-26380 affects Siemens SCALANCE X-300/ XR324/ XR324-12M family and related X-30x devices. A SNMP handling flaw allows an unauthenticated attacker to trigger a reboot by requesting specific SNMP information due to improper validation of SNMP keys (out-of-bounds read). Impact is reboot unle...

CVE-2022-26335

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-26335

CVE-2022-26335 affects Siemens SCALANCE X switch family (e.g., X302-7 X304-2FE, X307-2/3, X308-2/4M/XR324 series, SIPLUS NET variants). Affected devices do not properly validate the URI of incoming HTTP GET requests, allowing an unauthenticated remote attacker to crash the device. Reported affect...

CVE-2022-26334

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-26334

This CVE (CVE-2022-26334) is a buffer copy without checking size in Siemens SCALANCE X-300/XR324 family devices, triggered by unauthenticated HTTP GET requests that fail to validate the XNo parameter, leading to a device crash. Affected products include numerous SCALANCE X switch models (X302-7, ...

CVE-2022-25756

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25756

CVE-2022-25756 affects Siemens SCALANCE X-300 switch family devices (various models listed in the vulnerability entry). The issue is a Cross-Site Scripting (XSS) vulnerability in the device’s integrated web server, caused by improper neutralization of script-related HTML tags. An attacker could t...

CVE-2022-25755

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25755

Siemens SCALANCE X-300/XR3xx family devices are affected by CVE-2022-25755 due to the webserver missing specific security headers, enabling an unauthenticated remote attacker to potentially extract confidential session information under certain circumstances. Affected models span SCALANCE X302-7/...

CVE-2022-25754

CVE-2022-25754 affects Siemens SCALANCE X-300 switches and related models (web server on affected devices). The issue arises from the integrated web server, which could allow remote attackers to perform actions with the permissions of a victim user if the victim has an active session and is lured...

CVE-2022-25754

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25753

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25753

CVE-2022-25753 is a stack-based buffer overflow vulnerability in the CLI handling of arguments such as IP addresses on Siemens SCALANCE X-300/XR/X-308 family devices. The issue could allow an authenticated remote attacker to execute arbitrary code on affected devices. Affected products include a ...

CVE-2022-25752

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25752

CVE-2022-25752 relates to Siemens SCALANCE X-300/XR324 series devices where the webserver counts and uses session IDs/nonces insecurely. This design flaw could let an unauthenticated remote attacker brute‑force session IDs and hijack existing sessions, potentially affecting a wide range of SCALAN...

CVE-2022-25751

A vulnerability has been identified in SCALANCE X302-7 EEC 230V, SCALANCE X302-7 EEC 230V, coated, SCALANCE X302-7 EEC 24V, SCALANCE X302-7 EEC 24V, coated, SCALANCE X302-7 EEC 2x 230V, SCALANCE X302-7 EEC 2x 230V, coated, SCALANCE X302-7 EEC 2x 24V, SCALANCE X302-7 EEC 2x 24V, coated, SCALANCE...

CVE-2022-25751

CVE-2022-25751 affects Siemens SCALANCE X-300/XR324/X408-2/X320 etc. devices; root cause is improper validation of HTTP headers in the embedded web server, enabling an unauthenticated remote attacker to crash affected devices. Affected families include X-302/X-304/X-306/X-307/X-308/X-310/X-320/XR...

多款 Siemens 产品跨站请求伪造漏洞

SCALANCE X switches are used to connect industrial components such as programmable logic controllers PLCs or human-machine interfaces HMIs.SIPLUS extreme is designed for reliable operation under extreme conditions.A cross-site request forgery vulnerability exists in Siemens SCALANCE X-300 Switch...