CVE-2016-0800

mediumPriorität · beachten · 63EPSS 0.821 · 100. PerzentilExploit · funktionalDEEURUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · funktional

Likely / severe?

82.1% (100th) EPSS

CVSS 4.3 · medium

Is it mine?

117 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-22

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

BehobenSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
BehobenSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot
Update to V3.2.7 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814809/
MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)siemens_psirt
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)siemens_psirt
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)siemens_psirt
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)siemens_psirt
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)siemens_psirt
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationROX Icisa_csaf_ot
Siemens has released updates and encourages users to apply them as soon as possible. The following is a list of the products with their corresponding updates.
MitigationSCALANCE X200 IRT familycisa_csaf_ot
Siemens has released updates and encourages users to apply them as soon as possible. The following is a list of the products with their corresponding updates.
MitigationSCALANCE X200 RNA familycisa_csaf_ot
Siemens has released updates and encourages users to apply them as soon as possible. The following is a list of the products with their corresponding updates.
MitigationSCALANCE X200 familycisa_csaf_ot
Siemens has released updates and encourages users to apply them as soon as possible. The following is a list of the products with their corresponding updates.
MitigationSCALANCE X300 familycisa_csaf_ot
Siemens has released updates and encourages users to apply them as soon as possible. The following is a list of the products with their corresponding updates.
MitigationSCALANCE X414cisa_csaf_ot
Siemens has released updates and encourages users to apply them as soon as possible. The following is a list of the products with their corresponding updates.
MitigationSCALANCE X204RNA (HSR) (6GK5204-0BA00-2MB2)cisa_csaf_ot
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA (PRP) (6GK5204-0BA00-2KB2)cisa_csaf_ot
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA EEC (HSR) (6GK5204-0BS00-2NA3)cisa_csaf_ot
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA EEC (PRP) (6GK5204-0BS00-3LA3)cisa_csaf_ot
Deactivate the webserver if not required, and if deactivation is supported by the product
MitigationSCALANCE X204RNA EEC (PRP/HSR) (6GK5204-0BS00-3PA3)cisa_csaf_ot
Deactivate the webserver if not required, and if deactivation is supported by the product

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

5.9

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 2.9

v3.05.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USAusnutzbarkeit 2.2 · Auswirkung 3.6

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nsecondary · FSTEC (BDU) RU

v3.05.9mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Hsecondary · CVSS-BT (t0sche)

v3.04mediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:Nsecondary · CISA US

v3.14mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US

v3.14mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-200USprimärCWE-310USprimärCWE-310USCWE-326USCWE-787USCWE-787US

Exploits (2)

Öffentlicher Proof-of-Concept- und Exploit-Code.

betroffene Produkte (117)

Betroffene Produkte und Versionsbereiche.

Arista EOSalle Versionencert_bundDEcpe:/o:arista:arista_eos:-
Cisco ASA (Adaptive Security Appliance)alle Versionencert_bundDEcpe:/o:cisco:adaptive_security_appliance:-
Cisco IP Phonealle Versionencert_bundDEcpe:/h:cisco:ip_phone:-
Cisco Packet Traceralle Versionencert_bundDEcpe:/a:cisco:packet_tracer:-
Cisco Prime Collaborationalle Versionencert_bundDEcpe:/a:cisco:prime_collaboration:-
Cisco Security Manager (CSM)alle Versionencert_bundDEcpe:/a:cisco:security_manager:-
Cisco TelePresence Serveralle Versionencert_bundDEcpe:/a:cisco:telepresence_server:-
Cisco Unified Communications Manager (CUCM)alle Versionencert_bundDEcpe:/a:cisco:unified_communications_manager:-
Cisco Unified Computing System (UCS)alle Versionencert_bundDEcpe:/h:cisco:unified_computing_system:-
Cisco Unified IP Phonealle Versionencert_bundDEcpe:/h:cisco:unified_ip_phones:-
Cisco WebExalle Versionencert_bundDEcpe:/a:cisco:webex:-
Citrix Systems XenServeralle Versionencert_bundDEcpe:/a:citrix:xenserver:-
F5 BIG-IPalle Versionencert_bundDEcpe:/a:f5:big-ip:-
F5 Enterprise Manageralle Versionencert_bundDEcpe:/a:f5:enterprise_manager:-
FreeBSD Project FreeBSD OSalle Versionencert_bundDEcpe:/o:freebsd:freebsd:-
IBM AIX 5.3alle Versionencert_bundDEcpe:/o:ibm:aix:5.3
IBM AIX 6.1alle Versionencert_bundDEcpe:/o:ibm:aix:6.1
IBM AIX 7.1alle Versionencert_bundDEcpe:/o:ibm:aix:7.1
IBM AIX 7.2alle Versionencert_bundDEcpe:/o:ibm:aix:7.2
IBM FlashSystem 840alle Versionencert_bundDEcpe:/a:ibm:flashsystem:840

20 von 117 angezeigt

Advisories (4)

Hersteller- und Ökosystem-Meldungen dazu.

SSA-412672SSA-412672: Multiple OpenSSL and OpenSSH Vulnerabilities in SCALANCE X-200RNA Switch Devices before V3.2.72022-12-13csaf · siemens_psirtDE
SCALANCE X-200RNA switch devices before V3.2.7 contain multiple OpenSSL and OpenSSH vulnerabilities. The most severe of these vulnerabilities could allow a denial of service condition or could lead to execution of arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.
WID-SEC-W-2023-0427OpenSSL: Mehrere SchwachstellenDeutsch2016-03-01csaf · cert_bundDE
Ein anonymer, lokaler bzw. entfernter Angreifer kann mehrere Schwachstellen in OpenSSL, Ubuntu Linux, Debian Linux Wheezy (7.0), Debian Linux Jessie (8.0), Red Hat Enterprise Linux HPC Node, Red Hat Enterprise Linux Server EUS, Red Hat Enterprise Linux Workstation, Red Hat Enterprise Linux Server, Red Hat Enterprise Linux Desktop, Red Hat Enterprise Linux Server AUS, Arista EOS und Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen, beliebigen Programcode mit den Rechten des Dienstes auszuführen oder um einen Denial of Service Zustand herbeizuführen.
ICSA-16-103-03CSiemens Industrial Products DROWN Vulnerability (Update C)2016-01-14icsa · cisa_csaf_otUS
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
ICSA-22-349-21Siemens SCALANCE X-200RNA Switch Devices2022-12-13icsa · cisa_csaf_otUS
SCALANCE X-200RNA switch devices before V3.2.7 contain multiple OpenSSL and OpenSSH vulnerabilities. The most severe of these vulnerabilities could allow a denial of service condition or could lead to execution of arbitrary code. Siemens has released updates for the affected products and recommends to update to the latest versions.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund siemens_psirt cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2016-03-01geändert 2026-06-17

verwandt (22,079)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2026-20133US	high7.5OT kritisch	32.4% (98th)	KEV	2026-02-25
A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system. This vulnerability is due…
CVE-2026-20128US	—OT kritisch	7.22% (94th)	KEV	2026-02-25
A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to gain DCA user privileges on an affect…
CVE-2026-20122US	medium5.4OT kritisch	25.5% (98th)	KEV	2026-02-25
A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vul…
CVE-2025-68686US	—OT kritisch	29.5% (98th)	KEV	2026-02-10
An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.…
CVE-2026-20805US	—OT kritisch	7.46% (94th)	KEV	2026-01-13
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

+22074 weitere

Referenzen (192)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan