CVE-2020-28393

Published: May 12, 2021Modified: Nov 21, 2024

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).

Affected (11)

Products: Siemens: Scalance Xm 400 Firmware, Scalance Xr524 Firmware, Scalance Xr526 Firmware, Scalance Xr528 Firmware, Scalance Xr552 Firmware, Scalance Xm416 4c Firmware, Scalance Xm408 8c Firmware, Scalance Xm408 4c Firmware, Scalance Xm416 4c L3 Firmware, Scalance Xm408 8c L3 Firmware, Scalance Xm408 4c L3 Firmware

Siemens

11 products

Scalance Xm 400 Firmware

Scalance Xr524 Firmware

Scalance Xr526 Firmware

Scalance Xr528 Firmware

Scalance Xr552 Firmware

Scalance Xm416 4c Firmware

Scalance Xm408 8c Firmware

Scalance Xm408 4c Firmware

Scalance Xm416 4c L3 Firmware

Scalance Xm408 8c L3 Firmware

Scalance Xm408 4c L3 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm 400 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm 400	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xr524 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xr524	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xr526 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xr526	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xr528 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xr528	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xr552 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xr552	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm416 4c Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm416 4c	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm408 8c Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm408 8c	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm408 4c Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm408 4c	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm416 4c L3 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm416 4c L3	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm408 8c L3 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm408 8c L3	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Siemens Scalance Xm408 4c L3 Firmware	Before 6.4

Running on/with	Platform Versions
Siemens Scalance Xm408 4c L3	All versions

Related CWEs

CWE-682

Incorrect Calculation

The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

References (4)

https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf

Source: productcert@siemens.com

Vendor Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-131-10

Source: productcert@siemens.com

Third Party AdvisoryUS Government Resource

https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-21-131-10

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.