CVE-2022-40631
Description
A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT PRO (All versions < V5.5.0), SCALANCE X202-2IRT (All versions < V5.5.0), SCALANCE X202-2P IRT (All versions < V5.5.0), SCALANCE X202-2P IRT PRO (All versions < V5.5.0), SCALANCE X204-2 (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X204IRT (All versions < V5.5.0), SCALANCE X204IRT PRO (All versions < V5.5.0), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < V5.5.0), SCALANCE XF202-2P IRT (All versions < V5.5.0), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204-2 (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < V5.5.0), SCALANCE XF204IRT (All versions < V5.5.0), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.0). There is a cross-site scripting vulnerability on the affected devices, that if used by a threat actor, it could result in session hijacking.
How to fix
- siemens scalance_x200-4p_irt_firmware5.5.0 or later
- siemens scalance_x201-3p_irt_firmware5.5.0 or later
- siemens scalance_x201-3p_irt_pro_firmware5.5.0 or later
- siemens scalance_x202-2irt_firmware5.5.0 or later
- siemens scalance_x202-2p_irt_firmware5.5.0 or later
- siemens scalance_x202-2p_irt_pro_firmware5.5.0 or later
- siemens scalance_x204-2_firmware5.2.5 or later
- siemens scalance_x204-2fm_firmware5.2.5 or later
- siemens scalance_x204-2ld_firmware5.2.5 or later
- siemens scalance_x204-2ld_ts_firmware5.2.5 or later
- siemens scalance_x204-2ts_firmware5.2.5 or later
- siemens scalance_x204irt_firmware5.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| siemens scalance_x200-4p_irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x201-3p_irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x201-3p_irt_pro_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x202-2irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x202-2p_irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x202-2p_irt_pro_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x204-2_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x204-2fm_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x204-2ld_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x204-2ld_ts_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x204-2ts_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x204irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x204irt_pro_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_x206-1_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x206-1ld_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x208_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x208pro_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x212-2_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x212-2ld_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x216_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_x224_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_xf201-3p_irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_xf202-2p_irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_xf204_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_xf204-2_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_xf204-2ba_irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_xf204irt_firmware | v < 5.5.0 | 5.5.0 |
| siemens scalance_xf206-1_firmware | v < 5.2.5 | 5.2.5 |
| siemens scalance_xf208_firmware | v < 5.2.5 | 5.2.5 |
| siemens siplus_net_scalance_x202-2p_irt_firmware | v < 5.5.0 | 5.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.