PT-2025-24676 · Siemens · Scalance Xr326-8+20

Published

2025-06-10

·

Updated

2025-06-10

·

CVE-2025-40568

CVSS v3.1

4.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Name of the Vulnerable Software and Affected Versions RUGGEDCOM RST2428P versions prior to V3.2 SCALANCE XC316-8 versions prior to V3.2 SCALANCE XC324-4 versions prior to V3.2 SCALANCE XC324-4 EEC versions prior to V3.2 SCALANCE XC332 versions prior to V3.2 SCALANCE XC416-8 versions prior to V3.2 SCALANCE XC424-4 versions prior to V3.2 SCALANCE XC432 versions prior to V3.2 SCALANCE XCH328 versions prior to V3.2 SCALANCE XCM324 versions prior to V3.2 SCALANCE XCM328 versions prior to V3.2 SCALANCE XCM332 versions prior to V3.2 SCALANCE XR302-32 versions prior to V3.2 SCALANCE XR322-12 versions prior to V3.2 SCALANCE XR326-8 versions prior to V3.2 SCALANCE XR326-8 EEC versions prior to V3.2 SCALANCE XR502-32 versions prior to V3.2 SCALANCE XR522-12 versions prior to V3.2 SCALANCE XR526-8 versions prior to V3.2 SCALANCE XRH334 versions prior to V3.2 SCALANCE XRM334 versions prior to V3.2
Description An internal session termination functionality in the web interface of affected products contains an incorrect authorization check. This could allow an authenticated remote attacker with a "guest" role to terminate legitimate users' sessions.
Recommendations Update RUGGEDCOM RST2428P to version V3.2 or later. Update SCALANCE XC316-8 to version V3.2 or later. Update SCALANCE XC324-4 to version V3.2 or later. Update SCALANCE XC324-4 EEC to version V3.2 or later. Update SCALANCE XC332 to version V3.2 or later. Update SCALANCE XC416-8 to version V3.2 or later. Update SCALANCE XC424-4 to version V3.2 or later. Update SCALANCE XC432 to version V3.2 or later. Update SCALANCE XCH328 to version V3.2 or later. Update SCALANCE XCM324 to version V3.2 or later. Update SCALANCE XCM328 to version V3.2 or later. Update SCALANCE XCM332 to version V3.2 or later. Update SCALANCE XR302-32 to version V3.2 or later. Update SCALANCE XR322-12 to version V3.2 or later. Update SCALANCE XR326-8 to version V3.2 or later. Update SCALANCE XR326-8 EEC to version V3.2 or later. Update SCALANCE XR502-32 to version V3.2 or later. Update SCALANCE XR522-12 to version V3.2 or later. Update SCALANCE XR526-8 to version V3.2 or later. Update SCALANCE XRH334 to version V3.2 or later. Update SCALANCE XRM334 to version V3.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-10417
CVE-2025-40568

Affected Products

Ruggedcom Rst2428P
Scalance Xc316-8
Scalance Xc324-4
Scalance Xr324-4M Eec
Scalance Xc332
Scalance Xc416-8
Scalance Xc424-4
Scalance Xc432
Scalance Xch328
Scalance Xcm324
Scalance Xcm328
Scalance Xcm332
Scalance Xr302-32
Scalance Xr322-12
Scalance Xr326-8
Scalance Xr326-8 Eec
Scalance Xr502-32
Scalance Xr522-12
Scalance Xr526-8C
Scalance Xrh334
Scalance Xrm334