Third-Party Component Vulnerabilities in SCALANCE LPE9403 before V2.0

An attacker could gain remote access to the SCALANCE LPE9403 industrial Ethernet switch and run arbitrary commands without authentication, potentially disrupting network connectivity throughout your facility or altering switch configuration.

This affects water authorities and electric utilities using SCALANCE LPE9403 industrial Ethernet switches for network infrastructure. These switches are often critical backbone devices providing connectivity between control systems, SCADA platforms, and field devices. Compromise could isolate or disrupt multiple control networks simultaneously.

An attacker on the network or with network access to the device can send specially crafted requests to exploit unpatched third-party components (CivetWeb, Docker, Linux Kernel, systemd) running on the switch. No credentials or user interaction are required. The attacker gains code execution and can then modify routing rules, disrupt traffic, or pivot to other network devices.