Read the docs
TI-2020-17224 Aliases CVE-2020-28395GHSA-vfw8-4p7f-cjjh

Hard-coded credentials in Siemens SCALANCE X-200RNA switch family

Priority LOW 29CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

Why it matters now

EPSS 0.0119 68th percentileScored 2026-11-07
Fix Fixed SCALANCE X-200RNA switch family (Siemens): V3.2.7SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (Siemens): V4.1.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensSCALANCE X-200RNA switch familybefore V3.2.7V3.2.7Patch availableCNA
SiemensSCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)before V4.1.0V4.1.0Patch availableCNA
  • SCALANCE X-200RNA switch family VendorSiemens Affected before V3.2.7 Fixed in V3.2.7 Patch available CNA
  • SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) VendorSiemens Affected before V4.1.0 Fixed in V4.1.0 Patch available CNA

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:o:siemens:scalance_xr324-12m_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr324-12m:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:scalance_xr324-12m_ts_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr324-12m_ts:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:scalance_xr324-4m_eec_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr324-4m_eec:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:scalance_xr324-4m_poe_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr324-4m_poe:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:scalance_xr324-4m_poe_ts_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr324-4m_poe_ts:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:scalance_xr324-12m_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr324-12m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:scalance_xr324-12m_ts_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr324-12m_ts:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:scalance_xr324-4m_eec_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr324-4m_eec:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:scalance_xr324-4m_poe_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr324-4m_poe:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:scalance_xr324-4m_poe_ts_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr324-4m_poe_ts:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:siemens:scalance_xr324wg_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr324wg:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:scalance_xr326-2c_poe_wg_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr326-2c_poe_wg:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
cpe:2.3:o:siemens:scalance_xr328-4c_wg_firmware:*:*:*:*:*:*:*:*before 4.1.0VulnerableSiemens
cpe:2.3:h:siemens:scalance_xr328-4c_wg:-:*:*:*:*:*:*:*not specified by NVDRunning onSiemens
  • cpe:2.3:o:siemens:scalance_xr324wg_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr324wg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:scalance_xr326-2c_poe_wg_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr326-2c_poe_wg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens
  • cpe:2.3:o:siemens:scalance_xr328-4c_wg_firmware:*:*:*:*:*:*:*:* Versions before 4.1.0 Vulnerable ·Siemens
  • cpe:2.3:h:siemens:scalance_xr328-4c_wg:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Siemens

Remediation

  • Fix · CNA SCALANCE X-200RNA switch family (Siemens) Fixed in V3.2.7
  • Fix · CNA SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (Siemens) Fixed in V4.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-28395
  2. 2026-10-03 Alias added: GHSA-vfw8-4p7f-cjjh

References

Advisory 2

  • TI-2020-17228 Resource allocation without limits in Siemens Development/Evaluation Kits for PROFINET… CVSS 4.0HIGH 8.7
  • TI-2022-16670 Injection in Siemens RUGGEDCOM RM1224 LTE EU CVSS 3.1CRITICAL 9.1
  • TI-2022-09326 A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC… CVSS 3.1CRITICAL 9.8
  • TI-2022-16671 Resource allocation without limits in Siemens RUGGEDCOM RM1224 LTE EU CVSS 3.1HIGH 7.5
  • TI-2022-09327 Stack-based buffer overflow in Siemens SCALANCE X302-7 EEC CVSS 3.1HIGH 8.8
  • TI-2022-09328 Cross-site request forgery in Siemens SCALANCE X302-7 EEC CVSS 3.1HIGH 8.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences