Multiple Vulnerabilities in SCALANCE XCM-/XRM-300 before V2.4

An attacker could remotely take full control of your network switches, intercept communications between your PLC and engineering systems, or shut down network connectivity to critical water treatment or electrical infrastructure without any login credentials.

Water treatment and municipal electric utilities operating Siemens SCALANCE XCM/XRM-300 series managed industrial network switches. This includes facilities using these switches for backbone connectivity between control systems, SCADA networks, and remote terminal units (RTUs). Small to mid-size utilities with these switches in their critical infrastructure are directly affected.

An attacker on your network (or reachable via the internet if the switch is internet-facing) can send specially crafted network packets to the SCALANCE switch to exploit memory corruption, authentication bypass, or weak encryption vulnerabilities. This allows remote code execution directly on the switch with the ability to modify configurations, intercept traffic, or isolate critical control systems.