Log in Start free

Vulnerability · Published Jan 12, 2021 · Assigned by siemens

CVE-2020-15800

Critical 9.8

In plain English

A critical-severity heap buffer overflow in SCALANCE X-200 switch family (incl. SIPLUS NET variants) from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.7%top 23.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). The webserver of the affected devices contains a vulnerability that may lead to a heap overflow condition. An attacker could cause this condition on the webserver by sending specially crafted requests. This could stop the webserver temporarily.

Affected products (as reported)

VendorProductVersions
Siemens SCALANCE X-200 switch family (incl. SIPLUS NET variants) All versions < V5.2.5
Siemens SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) All versions < V5.5.0
Siemens SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) All versions < V4.1.0

Weakness: CWE-122

References