PT-2022-3573 · Siemens · Scalance X307-2+11

Published 2022-04-12 · Updated 2022-04-19 · CVE-2022-26335

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SCALANCE X302-7 SCALANCE X304-2FE SCALANCE X306-1LD FE SCALANCE X307-2 SCALANCE X307-3 SCALANCE X307-3LD SCALANCE X308-2 SCALANCE X310 SCALANCE X320-1 SCALANCE X408-2 SCALANCE XR324-4M SCALANCE XR324-12M SIPLUS NET SCALANCE X308-2

Description The issue is related to the improper validation of the URI of incoming HTTP GET requests, which could allow an unauthenticated remote attacker to crash affected devices by sending specially crafted HTTP GET requests.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-04357

CVE-2022-26335

Affected Products

Scalance X302-7

Scalance X304-2Fe

Scalance X306-1Ld Fe

Scalance X307-2

Scalance X307-3Ld

Scalance X308-2

Scalance X310

Scalance X320-1 Fe

Scalance X408-2

Scalance Xr324-12M

Scalance Xr324-4M

Siplus Net Scalance X308-2

References · 5

• https://osv.dev/vulnerability/CVE-2022-26335 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26335 · Security Note
• https://bdu.fstec.ru/vul/2022-04357 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-836527.pdf · Vendor Advisory
• https://t.me/cibsecurity/40600 · Telegram Post