Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), S...

CVE-2022-26380 · published 4 years ago
Summary

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated...

What to do
  • Update siemens scalance_x302-7eec_firmware to version 4.1.4 or later.
  • Update siemens scalance_x304-2fe_firmware to version 4.1.4 or later.
  • Update siemens scalance_x306-1ldfe_firmware to version 4.1.4 or later.
  • Update siemens scalance_x307-2eec_firmware to version 4.1.4 or later.
  • Update siemens scalance_x307-3_firmware to version 4.1.4 or later.
  • Update siemens scalance_x307-3ld_firmware to version 4.1.4 or later.
  • Update siemens scalance_x308-2_firmware to version 4.1.4 or later.
  • Update siemens scalance_x308-2ld_firmware to version 4.1.4 or later.
  • Update siemens scalance_x308-2lh_firmware to version 4.1.4 or later.
  • Update siemens scalance_x308-2lh\+_firmware to version 4.1.4 or later.
  • Update siemens scalance_x308-2m_firmware to version 4.1.4 or later.
  • Update siemens scalance_x308-2m_ts_firmware to version 4.1.4 or later.
  • Update siemens scalance_x310_firmware to version 4.1.4 or later.
  • Update siemens scalance_x310fe_firmware to version 4.1.4 or later.
  • Update siemens scalance_x320-1fe_firmware to version 4.1.4 or later.
  • Update siemens scalance_x320-1-2ldfe_firmware to version 4.1.4 or later.
  • Update siemens scalance_x408-2_firmware to version 4.1.4 or later.
  • Update siemens scalance_xr324-4m_eec_firmware to version 4.1.4 or later.
  • Update siemens scalance_xr324-4m_poe_firmware to version 4.1.4 or later.
  • Update siemens scalance_xr324-4m_poe_ts_firmware to version 4.1.4 or later.
  • Update siemens scalance_xr324-12m_firmware to version 4.1.4 or later.
  • Update siemens scalance_xr324-12m_ts_firmware to version 4.1.4 or later.
  • Update siemens siplus_net_scalance_x308-2_firmware to version 4.1.4 or later.
Affected software
VendorProductAffected versions
siemens scalance_x302-7eec_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x302-7eec_firmware:*:*:*:*:*:*:*:*
siemens scalance_x304-2fe_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x304-2fe_firmware:*:*:*:*:*:*:*:*
siemens scalance_x306-1ldfe_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x306-1ldfe_firmware:*:*:*:*:*:*:*:*
siemens scalance_x307-2eec_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x307-2eec_firmware:*:*:*:*:*:*:*:*
siemens scalance_x307-3_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x307-3_firmware:*:*:*:*:*:*:*:*
siemens scalance_x307-3ld_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x307-3ld_firmware:*:*:*:*:*:*:*:*
siemens scalance_x308-2_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x308-2_firmware:*:*:*:*:*:*:*:*
siemens scalance_x308-2ld_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x308-2ld_firmware:*:*:*:*:*:*:*:*
siemens scalance_x308-2lh_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x308-2lh_firmware:*:*:*:*:*:*:*:*
siemens scalance_x308-2lh\+_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x308-2lh\+_firmware:*:*:*:*:*:*:*:*
siemens scalance_x308-2m_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x308-2m_firmware:*:*:*:*:*:*:*:*
siemens scalance_x308-2m_poe_firmware All versions
cpe:2.3:o:siemens:scalance_x308-2m_poe_firmware:-:*:*:*:*:*:*:*
siemens scalance_x308-2m_ts_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x308-2m_ts_firmware:*:*:*:*:*:*:*:*
siemens scalance_x310_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x310_firmware:*:*:*:*:*:*:*:*
siemens scalance_x310fe_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x310fe_firmware:*:*:*:*:*:*:*:*
siemens scalance_x320-1fe_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x320-1fe_firmware:*:*:*:*:*:*:*:*
siemens scalance_x320-1-2ldfe_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x320-1-2ldfe_firmware:*:*:*:*:*:*:*:*
siemens scalance_x408-2_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_x408-2_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr324-4m_eec_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_xr324-4m_eec_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr324-4m_poe_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_xr324-4m_poe_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr324-4m_poe_ts_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_xr324-4m_poe_ts_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr324-12m_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_xr324-12m_firmware:*:*:*:*:*:*:*:*
siemens scalance_xr324-12m_ts_firmware < 4.1.4
cpe:2.3:o:siemens:scalance_xr324-12m_ts_firmware:*:*:*:*:*:*:*:*
siemens siplus_net_scalance_x308-2_firmware < 4.1.4
cpe:2.3:o:siemens:siplus_net_scalance_x308-2_firmware:*:*:*:*:*:*:*:*
Original advisory text
A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), S...
A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. Affected devices do not properly validate if a certain SNMP key exists. An attacker could use this to trigger a reboot of an affected device by requesting specific SNMP information from the device.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-125Out-of-bounds Read
Timeline
Published12 Apr 2022
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-26380 · NVD
Track software like this
Free during beta