Siemens SCALANCE X-200IRT Devices

An attacker positioned on your network could intercept SSH management connections to these switches and read or modify commands, potentially altering network configuration, access controls, or industrial process connectivity.

This affects industrial-grade managed switches used in manufacturing, chemical processing, power distribution, and water utilities for real-time communication (IRT) in control networks. Anyone managing SCALANCE X-200IRT, X-200P IRT, XF200-series IRT, or SIPLUS NET SCALANCE X202-2P IRT switches should evaluate patch status. Risk is higher in networks where these switches are managed over untrusted or shared network segments.

The attacker must be on the same network segment (LAN) as the affected switch to perform a man-in-the-middle attack. They would intercept SSH traffic and exploit the weak ciphers to decrypt or modify the encrypted session, allowing them to read commands or inject malicious configuration changes into the switch.