SSA-979775: Stack Overflow Vulnerability in SCALANCE and RUGGEDCOM Devices
Several firmware versions of the SCALANCE and RUGGEDCOM devices listed below are affected by a vulnerability in the passive listening feature that could allow an attacker to cause a reboot or, under specific circumstances, attain remote code execution of the affected devices. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-25667US | high8.8 | — | ||
A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4), SCALANCE M-800 (All versions >= V4.3 and < V6.4), SCALANCE S615 (All versions >= V4.3 and… | ||||
references
External citations — patches, advisories, analysis.
remediations (22)
- MitigationRUGGEDCOM RM1224
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE M-800
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE S615
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE SC-600 Family
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XB-200
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XC-200
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XF-200BA
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XM400
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XP-200
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XR-300WG
Deactivate the STP passive listening feature of the vulnerable devices
- MitigationSCALANCE XR500
Deactivate the STP passive listening feature of the vulnerable devices
- FixedRUGGEDCOM RM1224
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE M-800
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE S615
Update to V6.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109794349/ - FixedSCALANCE SC-600 Family
Update to V2.1.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793041/ - FixedSCALANCE XB-200
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/ - FixedSCALANCE XC-200
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/ - FixedSCALANCE XF-200BA
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/ - FixedSCALANCE XM400
Update to V6.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109764409/ - FixedSCALANCE XP-200
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/ - FixedSCALANCE XR-300WG
Update to V4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109762982/ - FixedSCALANCE XR500
Update to V6.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109761425/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan