Heap-based buffer overflow in Siemens RFID 181EIP
Priority MEDIUM 40CWE-122Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-122 and the CVSS impact.
Summary
A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.6), SCALANCE X-300 switch family (incl. SIPLUS NET variants) (All versions < V4.1.3), SCALANCE X408 (All versions < V4.1.3), SCALANCE X414 (All versions), SIMATIC RF182C (All versions). Unprivileged remote attackers located in the same local network segment (OSI Layer 2) could gain remote code execution on the affected products by sending a specially crafted DHCP response to a client's DHCP request.
Why it matters now
EPSS 0.00954 61st percentileScored 2026-11-07
Fix Fixed SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Siemens): V5.2.3SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (Siemens): V5.4.1+3 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | RFID 181EIP | All versions | — | No fix listed | CNA |
| Siemens | RUGGEDCOM Win | V4.4, V4.5, V5.0, and V5.1 | — | No fix listed | CNA |
| Siemens | SCALANCE X-200 switch family (incl. SIPLUS NET variants) | before V5.2.3 | V5.2.3 | Patch available | CNA |
| Siemens | SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) | before V5.4.1 | V5.4.1 | Patch available | CNA |
| Siemens | SCALANCE X-200RNA switch family | before V3.2.6 | V3.2.6 | Patch available | CNA |
| Siemens | SCALANCE X-300 switch family (incl. SIPLUS NET variants) | before V4.1.3 | V4.1.3 | Patch available | CNA |
| Siemens | SCALANCE X408 | before V4.1.3 | V4.1.3 | Patch available | CNA |
| Siemens | SCALANCE X414 | All versions | — | No fix listed | CNA |
| Siemens | SIMATIC RF182C | All versions | — | No fix listed | CNA |
- RFID 181EIP VendorSiemens Affected All versions Fixed in — No fix listed CNA
- RUGGEDCOM Win VendorSiemens Affected V4.4, V4.5, V5.0, and V5.1 Fixed in — No fix listed CNA
- SCALANCE X-200 switch family (incl. SIPLUS NET variants) VendorSiemens Affected before V5.2.3 Fixed in V5.2.3 Patch available CNA
- SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) VendorSiemens Affected before V5.4.1 Fixed in V5.4.1 Patch available CNA
- SCALANCE X-200RNA switch family VendorSiemens Affected before V3.2.6 Fixed in V3.2.6 Patch available CNA
- SCALANCE X-300 switch family (incl. SIPLUS NET variants) VendorSiemens Affected before V4.1.3 Fixed in V4.1.3 Patch available CNA
- SCALANCE X408 VendorSiemens Affected before V4.1.3 Fixed in V4.1.3 Patch available CNA
- SCALANCE X414 VendorSiemens Affected All versions Fixed in — No fix listed CNA
- SIMATIC RF182C VendorSiemens Affected All versions Fixed in — No fix listed CNA
CPE configurations NVD · 19
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:rfid_181-eip_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:rfid_181-eip:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:ruggedcom_wimax_firmware:4.4:*:*:*:*:*:*:* | 4.4 | Vulnerable | Siemens |
| cpe:2.3:o:siemens:ruggedcom_wimax_firmware:4.5:*:*:*:*:*:*:* | 4.5 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:ruggedcom_wimax:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x200_firmware:*:*:*:*:*:*:*:* | before 5.2.3 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x200irt_firmware:*:*:*:*:*:*:*:* | before 5.4.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x200irt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x204rna_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
- cpe:2.3:o:siemens:rfid_181-eip_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:rfid_181-eip:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:ruggedcom_wimax_firmware:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Siemens
- cpe:2.3:o:siemens:ruggedcom_wimax_firmware:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Siemens
- cpe:2.3:h:siemens:ruggedcom_wimax:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x200_firmware:*:*:*:*:*:*:*:* Versions before 5.2.3 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x200irt_firmware:*:*:*:*:*:*:*:* Versions before 5.4.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x200irt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x204rna_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
Show 9 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x408_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x408:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x414_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x414:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:simatic_rf182c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:simatic_rf182c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:h:siemens:scalance_x204rna:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x408_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x408:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x414_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x414:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:simatic_rf182c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:simatic_rf182c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SCALANCE X-200 switch family (incl. SIPLUS NET variants) (Siemens) Fixed in V5.2.3
- Fix · CNA SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (Siemens) Fixed in V5.4.1
- Fix · CNA SCALANCE X-200RNA switch family (Siemens) Fixed in V3.2.6
- Fix · CNA SCALANCE X-300 switch family (incl. SIPLUS NET variants) (Siemens) Fixed in V4.1.3
- Fix · CNA SCALANCE X408 (Siemens) Fixed in V4.1.3
Timeline
- 2026-10-02 Threatist record created from CVE-2018-4833
- 2026-10-03 Alias added: GHSA-w74m-fchp-7mq8
References
Sources
- CVE-2018-4833 · CVE Program
- CVE-2018-4833 · NVD
- FIRST EPSS
- GHSA-w74m-fchp-7mq8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences