Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.7

Act Now9.8SSA-412672Dec 13, 2022

Attack VectorNetwork

Auth RequiredNone

ComplexityLow

User InteractionNone needed

Summary

SCALANCE X-200RNA switch devices before V3.2.7 contain multiple OpenSSL and OpenSSH vulnerabilities that could allow denial of service or arbitrary code execution. Affected variants include HSR and PRP models with standard and EEC configurations.

What this means

What could happen

An attacker with network access to the switch could run arbitrary code on the device, potentially disrupting network connectivity across your control system or gaining persistent access to a critical network node.

Who's at risk

Water utilities and municipalities using SCALANCE X-200RNA managed switches in their control networks should prioritize this. These switches are commonly deployed in industrial Ethernet networks for process control, SCADA, and safety systems. All HSR (High-availability Seamless Redundancy) and PRP (Parallel Redundancy Protocol) variants are affected.

How it could be exploited

An attacker sends a specially crafted network request to the switch's OpenSSL or OpenSSH service without needing credentials. The vulnerability allows code execution on the switch, enabling the attacker to modify routing tables, capture traffic, or disable the device entirely.

Prerequisites

Network connectivity to the SCALANCE X-200RNA switch on its management or SSH port (typically port 22 for SSH, port 443 for web management)
No credentials required for exploitation of the OpenSSL vulnerability

remotely exploitableno authentication requiredlow complexityhigh EPSS score (93.9%)affects network infrastructure

Exploitability

High exploit probability (EPSS 93.9%)

Affected products (5)

5 with fix

ProductAffected VersionsFix Status

SCALANCE X204RNA (HSR)< V3.2.73.2.7

SCALANCE X204RNA (PRP)< V3.2.73.2.7

SCALANCE X204RNA EEC (HSR)< V3.2.73.2.7

SCALANCE X204RNA EEC (PRP)< V3.2.73.2.7

SCALANCE X204RNA EEC (PRP/HSR)< V3.2.73.2.7

Remediation & Mitigation

0/3

Do now

0/2

HARDENINGRestrict network access to the switch's management port (SSH, web UI) to authorized engineering workstations and management networks only, using firewall rules or network segmentation

WORKAROUNDDisable SSH or web management access on untrusted network segments if not actively used for remote management

Schedule — requires maintenance window

0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate SCALANCE X-200RNA switches to firmware version 3.2.7 or later

CVEs (83)

CVE-2003-0190 CVE-2003-1562 CVE-2014-8176 CVE-2015-0207 CVE-2015-0208 CVE-2015-0209 CVE-2015-0285 CVE-2015-0286 CVE-2015-0287 CVE-2015-0288 CVE-2015-0289 CVE-2015-0290 CVE-2015-0291 CVE-2015-0292 CVE-2015-0293 CVE-2015-1787 CVE-2015-1788 CVE-2015-1789 CVE-2015-1790 CVE-2015-1791 CVE-2015-1792 CVE-2015-1794 CVE-2015-3193 CVE-2015-3194 CVE-2015-3195 CVE-2015-3196 CVE-2015-3197 CVE-2015-4000 CVE-2015-5352 CVE-2015-5600 CVE-2015-6563 CVE-2015-6564 CVE-2015-6565 CVE-2015-8325 CVE-2016-0701 CVE-2016-0702 CVE-2016-0703 CVE-2016-0704 CVE-2016-0705 CVE-2016-0777 CVE-2016-0778 CVE-2016-0797 CVE-2016-0798 CVE-2016-0799 CVE-2016-0800 CVE-2016-1907 CVE-2016-1908 CVE-2016-2105 CVE-2016-2106 CVE-2016-2107 CVE-2016-2108 CVE-2016-2109 CVE-2016-2176 CVE-2016-2177 CVE-2016-2178 CVE-2016-2179 CVE-2016-2180 CVE-2016-2181 CVE-2016-2182 CVE-2016-2183 CVE-2016-6210 CVE-2016-6302 CVE-2016-6303 CVE-2016-6304 CVE-2016-6305 CVE-2016-6306 CVE-2016-6307 CVE-2016-6308 CVE-2016-6515 CVE-2016-8858 CVE-2016-10009 CVE-2016-10010 CVE-2016-10011 CVE-2016-10012 CVE-2017-3735 CVE-2017-15906 CVE-2018-15473 CVE-2018-20685 CVE-2019-1552 CVE-2019-6109 CVE-2019-6110 CVE-2019-6111 CVE-2019-16905

View full Siemens ProductCERT advisory

↑↓ Navigate · Esc Close

API: /api/v1/advisories/1cac71d4-0e57-47bb-bd97-3133bf110661