Cross-site scripting in Siemens SCALANCE X-200IRT switch family
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79.
Summary
A vulnerability has been identified in SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1), SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.3). A remote, authenticated attacker with access to the configuration web server could be able to store script code on the web site, if the HRP redundancy option is set. This code could be executed in the web browser of victims visiting this web site (XSS), affecting its confidentiality, integrity and availability. User interaction is required for successful exploitation, as the user needs to visit the manipulated web site. At the stage of publishing this security advisory no public exploitation is known. The vendor has confirmed the vulnerability and provides mitigations to resolve it.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) | before V5.4.1 | V5.4.1 | Patch available | CNA |
| Siemens | SCALANCE X-200RNA switch family | before V3.2.7 | V3.2.7 | Patch available | CNA |
| Siemens | SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) | before V4.1.3 | V4.1.3 | Patch available | CNA |
- SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) VendorSiemens Affected before V5.4.1 Fixed in V5.4.1 Patch available CNA
- SCALANCE X-200RNA switch family VendorSiemens Affected before V3.2.7 Fixed in V3.2.7 Patch available CNA
- SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) VendorSiemens Affected before V4.1.3 Fixed in V4.1.3 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:siemens:scalance_x200irt_firmware:*:*:*:*:*:*:*:* | before 5.4.1 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x200_irt:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
| cpe:2.3:o:siemens:scalance_x200_firmware:*:*:*:*:*:*:*:* | before 5.2.3 | Vulnerable | Siemens |
| cpe:2.3:h:siemens:scalance_x200:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Siemens |
- cpe:2.3:o:siemens:scalance_x200irt_firmware:*:*:*:*:*:*:*:* Versions before 5.4.1 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x200_irt:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
- cpe:2.3:o:siemens:scalance_x200_firmware:*:*:*:*:*:*:*:* Versions before 5.2.3 Vulnerable ·Siemens
- cpe:2.3:h:siemens:scalance_x200:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Remediation
- Fix · CNA SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (Siemens) Fixed in V5.4.1
- Fix · CNA SCALANCE X-200RNA switch family (Siemens) Fixed in V3.2.7
- Fix · CNA SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (Siemens) Fixed in V4.1.3
Timeline
- 2026-10-02 Threatist record created from CVE-2018-4842
- 2026-10-03 Alias added: GHSA-89f2-v4jr-22cm
References
More Siemens Scalance X200 Firmware vulnerabilities
- TI-2018-03410 Heap-based buffer overflow in Siemens RFID 181EIP CVSS 3.0HIGH 8.8
- TI-2017-01922 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
- TI-2017-01923 Uncontrolled resource consumption in Siemens Development/Evaluation Kits for PROFINET IO… CVSS 4.0HIGH 7.1
Sources
- CVE-2018-4842 · CVE Program
- CVE-2018-4842 · NVD
- FIRST EPSS
- GHSA-89f2-v4jr-22cm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences