CVE-2022-40631 : A vulnerability has been identified in SCALANCE X200-4P IRT (All versions

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT (All versions < V5.5.0), SCALANCE X201-3P IRT PRO (All versions < V5.5.0), SCALANCE X202-2IRT (All versions < V5.5.0), SCALANCE X202-2P IRT (All versions < V5.5.0), SCALANCE X202-2P IRT PRO (All versions < V5.5.0), SCALANCE X204-2 (All versions < V5.2.5), SCALANCE X204-2FM (All versions < V5.2.5), SCALANCE X204-2LD (All versions < V5.2.5), SCALANCE X204-2LD TS (All versions < V5.2.5), SCALANCE X204-2TS (All versions < V5.2.5), SCALANCE X204IRT (All versions < V5.5.0), SCALANCE X204IRT PRO (All versions < V5.5.0), SCALANCE X206-1 (All versions < V5.2.5), SCALANCE X206-1LD (All versions < V5.2.5), SCALANCE X208 (All versions < V5.2.5), SCALANCE X208PRO (All versions < V5.2.5), SCALANCE X212-2 (All versions < V5.2.5), SCALANCE X212-2LD (All versions < V5.2.5), SCALANCE X216 (All versions < V5.2.5), SCALANCE X224 (All versions < V5.2.5), SCALANCE XF201-3P IRT (All versions < V5.5.0), SCALANCE XF202-2P IRT (All versions < V5.5.0), SCALANCE XF204 (All versions < V5.2.5), SCALANCE XF204-2 (All versions < V5.2.5), SCALANCE XF204-2BA IRT (All versions < V5.5.0), SCALANCE XF204IRT (All versions < V5.5.0), SCALANCE XF206-1 (All versions < V5.2.5), SCALANCE XF208 (All versions < V5.2.5), SIPLUS NET SCALANCE X202-2P IRT (All versions < V5.5.0). There is a cross-site scripting vulnerability on the affected devices, that if used by a threat actor, it could result in session hijacking.

Published 2022-10-11 11:15:11

Updated 2022-10-14 17:07:55

Source Siemens AG

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2022-40631

Siemens » Scalance X200-4p Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x200-4p_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X200-4p Irt » Version: N/A
Siemens » Scalance X201-3p Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x201-3p_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X201-3p Irt » Version: N/A
Siemens » Scalance X201-3p Irt Pro Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x201-3p_irt_pro_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X201-3p Irt Pro » Version: N/A
Siemens » Scalance X202-2p Irt Pro Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x202-2p_irt_pro_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X202-2p Irt Pro » Version: N/A
Siemens » Scalance X204-2 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x204-2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204-2 » Version: N/A
Siemens » Scalance X204-2fm Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x204-2fm_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204-2fm » Version: N/A
Siemens » Scalance X204-2ld Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x204-2ld_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204-2ld » Version: N/A
Siemens » Scalance X204-2ld Ts Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x204-2ld_ts_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204-2ld Ts » Version: N/A
Siemens » Scalance X204-2ts Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x204-2ts_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204-2ts » Version: N/A
Siemens » Scalance X206-1 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x206-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X206-1 » Version: N/A
Siemens » Scalance X206-1ld Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x206-1ld_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X206-1ld » Version: N/A
Siemens » Scalance X208 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x208_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X208 » Version: N/A
Siemens » Scalance X208pro Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x208pro_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X208pro » Version: N/A
Siemens » Scalance X212-2 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x212-2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X212-2 » Version: N/A
Siemens » Scalance X212-2ld Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x212-2ld_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X212-2ld » Version: N/A
Siemens » Scalance X216 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x216_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X216 » Version: N/A
Siemens » Scalance X224 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_x224_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X224 » Version: N/A
Siemens » Scalance Xf201-3p Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_xf201-3p_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf201-3p Irt » Version: N/A
Siemens » Scalance Xf202-2p Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_xf202-2p_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf202-2p Irt » Version: N/A
Siemens » Scalance Xf204 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_xf204_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf204 » Version: N/A
Siemens » Scalance Xf204-2 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_xf204-2_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf204-2 » Version: N/A
Siemens » Scalance Xf204-2ba Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_xf204-2ba_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf204-2ba Irt » Version: N/A
Siemens » Scalance Xf206-1 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_xf206-1_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf206-1 » Version: N/A
Siemens » Scalance Xf208 Firmware
Versions before (<) 5.2.5
cpe:2.3:o:siemens:scalance_xf208_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf208 » Version: N/A
Siemens » Scalance X202-2irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x202-2irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X202-2irt » Version: N/A
Siemens » Scalance X204irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x204irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204irt » Version: N/A
Siemens » Scalance Xf204irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_xf204irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance Xf204irt » Version: N/A
Siemens » Scalance X202-2p Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x202-2p_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X202-2p Irt » Version: N/A
Siemens » Scalance X204irt Pro Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:scalance_x204irt_pro_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Scalance X204irt Pro » Version: N/A
Siemens » Siplus Net Scalance X202-2p Irt Firmware
Versions before (<) 5.5.0
cpe:2.3:o:siemens:siplus_net_scalance_x202-2p_irt_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Siemens » Siplus Net Scalance X202-2p Irt » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2022-40631

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2022-40631

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.1	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	2.8	2.7	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Changed Confidentiality: Low Integrity: Low Availability: None

CWE ids for CVE-2022-40631

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: productcert@siemens.com (Primary)

References for CVE-2022-40631

https://cert-portal.siemens.com/productcert/pdf/ssa-501891.pdf

Vendor Advisory

Jump to

Vulnerability Details : CVE-2022-40631

Products affected by CVE-2022-40631

Exploit prediction scoring system (EPSS) score for CVE-2022-40631

CVSS scores for CVE-2022-40631

CWE ids for CVE-2022-40631

References for CVE-2022-40631