Multiple Vulnerabilities in SCALANCE LPE9403 before V2.1

An attacker with network access and low privileges could execute arbitrary commands, bypass authentication controls, access sensitive files, or crash the SCALANCE LPE9403, disrupting network switching and potentially isolating critical industrial equipment from the control network.

Municipal water authorities, electric utilities, and other critical infrastructure operators who use Siemens SCALANCE LPE9403 managed switches for industrial network segregation. This device is commonly deployed at the edge of control networks to provide secure switching and VPN capabilities. Affected organizations should prioritize assessment if the LPE9403 is used to isolate SCADA networks, RTU networks, or other safety-critical segments.

An attacker on the network with low-level credentials (e.g., a basic operator account) could exploit command injection or buffer overflow vulnerabilities in the LPE9403's management interface to execute arbitrary commands. These commands could then be used to modify network routing, access configuration files containing credentials, or crash the device entirely.