CVE-2022-26647

siemens scalance x200-4p irt firmware, siemens scalance x201-3p irt firmware, siemens scalance x201-3p irt pro firmware +26 lainnya

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2022-26647

Katalog CVE

CVSS 8.8 · High EPSS 1,2%

Kerentanan Use of Insufficiently Random Values pada siemens scalance x200-4p irt firmware, siemens scalance x201-3p irt firmware +27 lainnya. Skor CVSS 3.1 8.8 (High) menurut siemens.com.

Deskripsi (NVD)

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.

Rincian

Terbit di NVD
12 Juli 2022
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
8.8 (High), sumber siemens.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-330: Use of Insufficiently Random Values
EPSS (30 hari)
1,2% peluang dieksploitasi; lebih tinggi dari 66,6% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
siemens scalance x200-4p irt firmware Semua versi
siemens scalance x201-3p irt firmware Semua versi
siemens scalance x201-3p irt pro firmware Semua versi
siemens scalance x202-2irt firmware Semua versi
siemens scalance x202-2p irt firmware Semua versi
siemens scalance x202-2p irt pro firmware Semua versi
siemens scalance x204-2 firmware Semua versi sebelum 5.2.6
siemens scalance x204-2fm firmware Semua versi sebelum 5.2.6
siemens scalance x204-2ld firmware Semua versi sebelum 5.2.6
siemens scalance x204-2ld ts firmware Semua versi sebelum 5.2.6
siemens scalance x204-2ts firmware Semua versi sebelum 5.2.6
siemens scalance x204irt firmware Semua versi
siemens scalance x204irt pro firmware Semua versi
siemens scalance x206-1 firmware Semua versi sebelum 5.2.6
siemens scalance x206-1ld firmware Semua versi sebelum 5.2.6
siemens scalance x208 firmware Semua versi sebelum 5.2.6
siemens scalance x208 pro firmware Semua versi sebelum 5.2.6
siemens scalance x212-2 firmware Semua versi sebelum 5.2.6
siemens scalance x212-2ld firmware Semua versi sebelum 5.2.6
siemens scalance x216 firmware Semua versi sebelum 5.2.6
siemens scalance x224 firmware Semua versi sebelum 5.2.6
siemens scalance xf201-3p irt firmware Semua versi
siemens scalance xf202-2p irt firmware Semua versi
siemens scalance xf204 firmware Semua versi sebelum 5.2.6
siemens scalance xf204-2 firmware Semua versi sebelum 5.2.6
siemens scalance xf204-2ba irt firmware Semua versi
siemens scalance xf204irt firmware Semua versi
siemens scalance xf206-1 firmware Semua versi sebelum 5.2.6
siemens scalance xf208 firmware Semua versi sebelum 5.2.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.