Siemens SCALANCE XM-400 and XR-500 Devices
SCALANCE XM-400 and XR-500 devices contain a vulnerability in the OSPF protocol implementation that could allow an unauthenticated remote attacker to create a permanent denial-of-service condition. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-28393US | high7.5 | — | ||
An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabl… | ||||
references
External citations — patches, advisories, analysis.
- SSA-116379: Denial-of-Service Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices - CSAF Versionself
- SSA-116379: Denial-of-Service Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices - PDF Versionself
- SSA-116379: Denial-of-Service Vulnerability in OSPF Packet Handling of SCALANCE XM-400 and XR-500 Devices - TXT Versionself
- ICS Advisory ICSA-21-131-10 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-131-10 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (4)
- MitigationSCALANCE XM-400 family
Disable OSPF in the layer 3 configuration menu (note that OSPF is disabled by default). The vulnerability is not exploitable, when OSPF is disabled.
- MitigationSCALANCE XR-500 family
Disable OSPF in the layer 3 configuration menu (note that OSPF is disabled by default). The vulnerability is not exploitable, when OSPF is disabled.
- FixedSCALANCE XM-400 family
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109796319/ - FixedSCALANCE XR-500 family
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109796317/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan