CVE-2020-28393
High
Description
An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).
SeverityHigh
CVSS7.5
Exploit probability—
ProductSiemens Scalance Xm-400 Firmware
PublishedMay 12, 2021
First seenMay 12, 2021
Weakness typeCWE-682CWE-682
How to fix
Update
- siemens scalance_xm-400_firmware6.4 or later
- siemens scalance_xr524_firmware6.4 or later
- siemens scalance_xr526_firmware6.4 or later
- siemens scalance_xr528_firmware6.4 or later
- siemens scalance_xr552_firmware6.4 or later
- siemens scalance_xm416-4c_firmware6.4 or later
- siemens scalance_xm408-8c_firmware6.4 or later
- siemens scalance_xm408-4c_firmware6.4 or later
- siemens scalance_xm416-4c_l3_firmware6.4 or later
- siemens scalance_xm408-8c_l3_firmware6.4 or later
- siemens scalance_xm408-4c_l3_firmware6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens scalance_xm-400_firmware | v < 6.4 | 6.4 |
| siemens scalance_xr524_firmware | v < 6.4 | 6.4 |
| siemens scalance_xr526_firmware | v < 6.4 | 6.4 |
| siemens scalance_xr528_firmware | v < 6.4 | 6.4 |
| siemens scalance_xr552_firmware | v < 6.4 | 6.4 |
| siemens scalance_xm416-4c_firmware | v < 6.4 | 6.4 |
| siemens scalance_xm408-8c_firmware | v < 6.4 | 6.4 |
| siemens scalance_xm408-4c_firmware | v < 6.4 | 6.4 |
| siemens scalance_xm416-4c_l3_firmware | v < 6.4 | 6.4 |
| siemens scalance_xm408-8c_l3_firmware | v < 6.4 | 6.4 |
| siemens scalance_xm408-4c_l3_firmware | v < 6.4 | 6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.