Lucene search

[email protected]NVD:CVE-2023-29054

HistoryApr 11, 2023 - 10:15 a.m.

CVE-2023-29054

2023-04-1110:15:18

CWE-326

[email protected]

web.nvd.nist.gov

vulnerability

scalance devices

weak ssh

man-in-the-middle

unauthorized attacker

data modification

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.8%

JSON

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.2). The SSH server on affected devices is configured to offer weak ciphers by default.

This could allow an unauthorized attacker in a man-in-the-middle position to read and modify any data
passed over the connection between legitimate clients and the affected device.

Affected configurations

NVD

Node

siemensscalance_x200-4p_irt_firmwareRange<5.5.2

AND

siemensscalance_x200-4p_irtMatch-

Node

siemensscalance_x201-3p_irt_firmwareRange<5.5.2

AND

siemensscalance_x201-3p_irtMatch-

Node

siemensscalance_x201-3p_irt_pro_firmwareRange<5.5.2

AND

siemensscalance_x201-3p_irt_proMatch-

Node

siemensscalance_x202-2irt_firmwareRange<5.5.2

AND

siemensscalance_x202-2irtMatch-

Node

siemensscalance_x202-2irt_firmwareRange<5.5.2

AND

siemensscalance_x202-2irtMatch-

Node

siemensscalance_x202-2p_irt_firmwareRange<5.5.2

AND

siemensscalance_x202-2p_irtMatch-

Node

siemensscalance_x202-2p_irt_pro_firmwareRange<5.5.2

AND

siemensscalance_x202-2p_irt_proMatch-

Node

siemensscalance_x204irt_firmwareRange<5.5.2

AND

siemensscalance_x204irtMatch-

Node

siemensscalance_x204irt_firmwareRange<5.5.2

AND

siemensscalance_x204irtMatch-

Node

siemensscalance_x204irt_pro_firmwareRange<5.5.2

AND

siemensscalance_x204irt_proMatch-

Node

siemensscalance_xf201-3p_irt_firmwareRange<5.5.2

AND

siemensscalance_xf201-3p_irtMatch-

Node

siemensscalance_xf202-2p_irt_firmwareRange<5.5.2

AND

siemensscalance_xf202-2p_irtMatch-

Node

siemensscalance_xf204-2ba_irt_firmwareRange<5.5.2

AND

siemensscalance_xf204-2ba_irtMatch-

Node

siemensscalance_xf204irt_firmwareRange<5.5.2

AND

siemensscalance_xf204irtMatch-

Node

siemenssiplus_net_scalance_x202-2p_irt_firmwareRange<5.5.2

AND

siemenssiplus_net_scalance_x202-2p_irtMatch-

References

cert-portal.siemens.com/productcert/pdf/ssa-479249.pdf

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.8%

JSON

Related for NVD:CVE-2023-29054

cve1 prion1 ics1 cvelist1 nessus1