Medium severity · published Jan 12, 2021
CVE-2020-28395
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl
5.9
CVSS
1.2%
EPSS
No
On KEV
Description
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 68% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SX
SCALANCE X-200RNA switch family · Siemens
All versions < V3.2.7 · source: vendor
SX
SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) · Siemens
All versions < V4.1.0 · source: vendor
SX
Scalance Xr324-12m Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr324-12m TS Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr324-4m Eec Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr324-4m Poe Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr324-4m Poe TS Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr324wg Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr326-2c Poe WG Firmware · Siemens
before 4.1.0 · source: NVD
SX
Scalance Xr328-4c WG Firmware · Siemens
before 4.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-28395
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-28395
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02
More from SCALANCE X-200RNA switch family
8.8
CVE-2018-4833
A vulnerability has been identified in RFID 181EIP (All versions), RUGGEDCOM Win (V4.4, V4.5, V5.0, and V5.1), SCALANCE X-200 switch family (incl
6.1
CVE-2018-4848
A vulnerability has been identified in SCALANCE X-200 switch family (incl
5.9
CVE-2020-28391
A vulnerability has been identified in SCALANCE X-200 switch family (incl
5.4
CVE-2019-13924
A vulnerability has been identified in SCALANCE S602 (All versions < V4.1), SCALANCE S612 (All versions < V4.1), SCALANCE S623 (All versions < V4.1), SCALANCE S627-2M (All…
4.8
CVE-2018-4842
A vulnerability has been identified in SCALANCE X-200IRT switch family (incl