CVE-2020-15799

high-risk
Published 2021-01-12

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0). The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products.

Do I need to act?

-
0.49% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.5/10 Medium
NETWORK / LOW complexity

Affected Products (20)

Scalance X200-4Pirt Firmware
Scalance X201-3Pirt Firmware
Scalance X202-2Irt Firmware
Scalance X202-2Pirt Firmware
Scalance X202-2Pirt Siplus Net Firmware
Scalance X204Irt Firmware
Scalance X307-3 Firmware
Scalance X307-3Ld Firmware
Scalance X308-2 Firmware
Scalance X308-2Ld Firmware
Scalance X308-2Lh Firmware
Scalance X308-2Lh\+ Firmware
Scalance X308-2M Firmware
Scalance X308-2M Ts Firmware
Scalance X310 Firmware
Scalance X310Fe Firmware
Scalance X320-1Fe Firmware
Scalance X320-3Ldfe Firmware
Scalance Xb205-3 Firmware
Scalance Xb205-3Ld Firmware

Affected Vendors

Siemens

References (2)

Vendor Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf
Vendor Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf
53
/ 100
high-risk
Severity 24/34 · High
Exploitability 2/34 · Minimal
Exposure 27/34 · High