Buffer Overflow Vulnerability in SCALANCE X Switches

An attacker could crash your SCALANCE switch by sending a malformed web request, causing temporary loss of network connectivity and plant operations that depend on that switch. In a worst-case scenario, arbitrary code execution on the switch could allow an attacker to intercept or manipulate network traffic.

Water utilities and electric utilities operating Siemens SCALANCE X-series industrial Ethernet switches in their control networks. These switches are used for backbone network connectivity in distribution automation, pump stations, substation networks, and remote terminal units (RTUs). The vulnerability affects 50+ variants across the X300, X400, and XR300 product families in both managed and unmanaged configurations.

An attacker with network access to the switch's embedded web server (port 80/443) sends a malformed HTTP request with an oversized URL that overflows a buffer in the web server code. This causes the switch to either crash (denial of service) or execute attacker-supplied code running on the switch itself.