PT-2021-2206 · Siemens · Scalance X-200+1

Published 2021-01-12 · Updated 2022-07-28 · CVE-2020-15799

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SCALANCE X-200 switch family (incl. SIPLUS NET variants) versions prior to V5.2.5 SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) versions prior to V5.5.0

Description The issue is related to a lack of authentication for a critical function in the web server of the affected products. This could allow an unauthenticated attacker to reboot the device over the network by using special URLs from the integrated web server.

Recommendations For SCALANCE X-200 switch family (incl. SIPLUS NET variants) versions prior to V5.2.5, update to version V5.2.5 or later. For SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) versions prior to V5.5.0, update to version V5.5.0 or later. As a temporary workaround, consider restricting access to the integrated web server until a patch is applied.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2021-01115

CVE-2020-15799

Affected Products

Scalance X-200

Scalance X-200Irt

References · 6

• https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01115 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15799 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15799 · Security Note
• https://t.me/cibsecurity/22054 · Telegram Post
• https://t.me/cvenotify/8736 · Telegram Post