CVE Feed

    Dashboard / CVE / CVE-2020-28395

    CVE-2020-28395

    A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

    Published:Jan 12, 2021
    Last Modified:Nov 21, 2024
    EPS:Jan 12, 2021
    EPSS Score:0.0017
    CVSS Score:5.9

    Affected Products

    Vendor
    Siemens
    Product
    Scalance Xr324-12m
    Vendor
    Siemens
    Product
    Scalance Xr324-12m Firmware
    Vendor
    Siemens
    Product
    Scalance Xr324-12m Ts
    Vendor
    Siemens
    Product
    Scalance Xr324-12m Ts Firmware
    Vendor
    Siemens
    Product
    Scalance Xr324-4m Eec
    Vendor
    Siemens
    Product
    Scalance Xr324-4m Eec Firmware
    Vendor
    Siemens
    Product
    Scalance Xr324-4m Poe
    Vendor
    Siemens
    Product
    Scalance Xr324-4m Poe Firmware
    Vendor
    Siemens
    Product
    Scalance Xr324-4m Poe Ts
    Vendor
    Siemens
    Product
    Scalance Xr324-4m Poe Ts Firmware
    Vendor
    Siemens
    Product
    Scalance Xr324wg
    Vendor
    Siemens
    Product
    Scalance Xr324wg Firmware
    Vendor
    Siemens
    Product
    Scalance Xr326-2c Poe Wg
    Vendor
    Siemens
    Product
    Scalance Xr326-2c Poe Wg Firmware
    Vendor
    Siemens
    Product
    Scalance Xr328-4c Wg
    Vendor
    Siemens
    Product
    Scalance Xr328-4c Wg Firmware

    Exploits

    No exploit reference

    Related CVEs

    CVE-2022-36325 (CVSS 6.8) — Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This co…
    CVE-2022-36324 (CVSS 7.5) — Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthent…
    CVE-2022-36323 (CVSS 9.1) — Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker w…
    CVE-2022-26380 (CVSS 7.5) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…
    CVE-2022-26335 (CVSS 7.5) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…
    CVE-2022-26334 (CVSS 7.5) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…
    CVE-2022-25756 (CVSS 6.1) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…
    CVE-2022-25755 (CVSS 7.5) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…
    CVE-2022-25754 (CVSS 8.8) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…
    CVE-2022-25753 (CVSS 8.8) — A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANC…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High