SNMP Vulnerability in SCALANCE X302-7 Series and Other Siemens Products
CVE-2022-26380

7.5HIGH

Key Information:

Vendor

Siemens
Status
Scalance X302-7 Eec (230v)
Scalance X302-7 Eec (230v, Coated)
Scalance X302-7 Eec (24v)
Scalance X302-7 Eec (24v, Coated)
Vendor
CVE Published:
12 April 2022

What is CVE-2022-26380?

A vulnerability exists in multiple Siemens SCALANCE devices, allowing improper validation of specific SNMP keys. An attacker can exploit this weakness by sending requests for certain SNMP information, potentially triggering a device reboot. This poses significant risks, particularly in industrial environments where device stability is critical. Organizations utilizing affected SCALANCE products should assess their security posture and apply necessary mitigations as outlined in Siemens' official advisory.

Affected Version(s)

SCALANCE X302-7 EEC (230V, coated) All versions < V4.1.4

SCALANCE X302-7 EEC (230V) All versions < V4.1.4

SCALANCE X302-7 EEC (24V, coated) All versions < V4.1.4

References

https://cert-portal.siemens.com/productcert/pdf/ssa-83652...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.