Sensitive Data Exposure in SCALANCE X204RNA Products by Siemens
CVE-2022-46355

7.5HIGH

Key Information:

Vendor
Siemens
Status
Scalance X204rna (hsr)
Scalance X204rna (prp)
Scalance X204rna Eec (hsr)
Scalance X204rna Eec (prp)
Vendor
CVE Published:
13 December 2022

Summary

A significant vulnerability has been identified in multiple SCALANCE X204RNA products from Siemens. This issue allows for the unintended leakage of sensitive information via the HTTP Referer header, potentially exposing critical data to unauthorized actors. All versions prior to V3.2.7 are affected across various configurations, including HSR and PRP modes. Users of these devices should take immediate action to mitigate this risk by upgrading to the recommended version.

Affected Version(s)

SCALANCE X204RNA (HSR) All versions < V3.2.7

SCALANCE X204RNA (PRP) All versions < V3.2.7

SCALANCE X204RNA EEC (HSR) All versions < V3.2.7

References

https://cert-portal.siemens.com/productcert/pdf/ssa-36382...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.