{
  "document": {
    "title": "SSA-139628: Vulnerabilities in Web Server for Scalance X Products",
    "category": "Siemens Security Advisory",
    "csaf_version": "2.0",
    "publisher": {
      "name": "Siemens ProductCERT",
      "contact_details": "productcert@siemens.com",
      "category": "vendor",
      "namespace": "https://www.siemens.com"
    },
    "distribution": {
      "text": "Disclosure is not limited.",
      "tlp": {
        "label": "WHITE"
      }
    },
    "tracking": {
      "id": "SSA-139628",
      "status": "final",
      "version": "3",
      "revision_history": [
        {
          "number": "1",
          "legacy_version": "1.0",
          "date": "2021-01-12T00:00:00Z",
          "summary": "Publication Date"
        },
        {
          "number": "2",
          "legacy_version": "1.1",
          "date": "2021-02-09T00:00:00Z",
          "summary": "Added update information for SCALANCE X-200IRT switch family"
        },
        {
          "number": "3",
          "legacy_version": "1.2",
          "date": "2021-09-14T00:00:00Z",
          "summary": "Added solution for SCALANCE X-200 switch family"
        }
      ],
      "initial_release_date": "2021-01-12T00:00:00Z",
      "current_release_date": "2021-09-14T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      }
    },
    "notes": [
      {
        "title": "Summary",
        "category": "summary",
        "text": "Several SCALANCE X switches contain vulnerabilities in the web server of the affected devices.\n\nAn unauthenticated attacker could reboot, cause denial-of-service conditions and potentially impact the system by other means through heap and buffer overflow vulnerabilities.\n\nSiemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available."
      },
      {
        "title": "General Recommendations",
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\n\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity"
      },
      {
        "title": "Additional Resources",
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories"
      },
      {
        "title": "Terms of Use",
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use."
      }
    ],
    "references": [
      {
        "category": "self",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-139628.pdf",
        "summary": "SSA-139628: Vulnerabilities in Web Server for Scalance X Products - PDF Version"
      },
      {
        "category": "self",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-139628.txt",
        "summary": "SSA-139628: Vulnerabilities in Web Server for Scalance X Products - TXT Version"
      },
      {
        "category": "self",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-139628.json",
        "summary": "SSA-139628: Vulnerabilities in Web Server for Scalance X Products - CSAF Version"
      }
    ]
  },
  "product_tree": {
    "branches": [
      {
        "name": "Siemens",
        "category": "vendor",
        "branches": [
          {
            "name": "SCALANCE X-200 switch family (incl. SIPLUS NET variants)",
            "category": "product_name",
            "branches": [
              {
                "name": "< V5.2.5",
                "category": "product_version_range",
                "product": {
                  "product_id": "1",
                  "name": "SCALANCE X-200 switch family (incl. SIPLUS NET variants)"
                }
              }
            ]
          },
          {
            "name": "SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)",
            "category": "product_name",
            "branches": [
              {
                "name": "< V5.5.0",
                "category": "product_version_range",
                "product": {
                  "product_id": "2",
                  "name": "SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)"
                }
              }
            ]
          },
          {
            "name": "SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)",
            "category": "product_name",
            "branches": [
              {
                "name": "< V4.1.0",
                "category": "product_version_range",
                "product": {
                  "product_id": "3",
                  "name": "SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)"
                }
              }
            ]
          }
        ]
      }
    ]
  },
  "vulnerabilities": [
    {
      "title": "CVE-2020-15799",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "The vulnerability could allow an unauthenticated attacker to reboot the device over the network by using special urls from integrated web server of the affected products."
        }
      ],
      "cve": "CVE-2020-15799",
      "cwe": {
        "id": "CWE-306",
        "name": "Missing Authentication for Critical Function"
      },
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V5.2.5 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109801131/"
        },
        {
          "product_ids": [
            "2"
          ],
          "category": "vendor_fix",
          "details": "Update to V5.5.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109792534/"
        },
        {
          "product_ids": [
            "1",
            "2"
          ],
          "category": "mitigation",
          "details": "Limit network traffic of web servers of Scalance X switches to trusted connections by firewall rules (port 443/tcp)."
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109801131/",
          "summary": "CVE-2020-15799 - SCALANCE X-200 switch family (incl. SIPLUS NET variants)"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109792534/",
          "summary": "CVE-2020-15799 - SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-15799.json",
          "summary": "CVE-2020-15799 Mitre 5.0 json"
        }
      ]
    },
    {
      "title": "CVE-2020-15800",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "The webserver of the affected devices contains a vulnerability that may lead to a heap overflow condition. An attacker could cause this condition on the webserver by sending specially crafted requests. This could stop the webserver temporarily."
        }
      ],
      "cve": "CVE-2020-15800",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C"
          },
          "products": [
            "1",
            "2",
            "3"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V5.2.5 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109801131/"
        },
        {
          "product_ids": [
            "2"
          ],
          "category": "vendor_fix",
          "details": "Update to V5.5.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109792534/"
        },
        {
          "product_ids": [
            "3"
          ],
          "category": "vendor_fix",
          "details": "Update to V4.1.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109773547/"
        },
        {
          "product_ids": [
            "1",
            "2",
            "3"
          ],
          "category": "mitigation",
          "details": "Limit network traffic of web servers of Scalance X switches to trusted connections by firewall rules (port 443/tcp)."
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109801131/",
          "summary": "CVE-2020-15800 - SCALANCE X-200 switch family (incl. SIPLUS NET variants)"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109792534/",
          "summary": "CVE-2020-15800 - SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109773547/",
          "summary": "CVE-2020-15800 - SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants)"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-15800.json",
          "summary": "CVE-2020-15800 Mitre 5.0 json"
        }
      ]
    },
    {
      "title": "CVE-2020-25226",
      "notes": [
        {
          "title": "Summary",
          "category": "summary",
          "text": "The web server of the affected devices contains a vulnerability that may lead to a buffer overflow condition. An attacker could cause this condition on the webserver by sending a specially crafted request. The webserver could stop and not recover anymore."
        }
      ],
      "cve": "CVE-2020-25226",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "version": "3.1",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:C"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "remediations": [
        {
          "product_ids": [
            "1"
          ],
          "category": "vendor_fix",
          "details": "Update to V5.2.5 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109801131/"
        },
        {
          "product_ids": [
            "2"
          ],
          "category": "vendor_fix",
          "details": "Update to V5.5.0 or later version",
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109792534/"
        },
        {
          "product_ids": [
            "1",
            "2"
          ],
          "category": "mitigation",
          "details": "Limit network traffic of web servers of Scalance X switches to trusted connections by firewall rules (port 443/tcp)."
        }
      ],
      "references": [
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109801131/",
          "summary": "CVE-2020-25226 - SCALANCE X-200 switch family (incl. SIPLUS NET variants)"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109792534/",
          "summary": "CVE-2020-25226 - SCALANCE X-200IRT switch family (incl. SIPLUS NET variants)"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/mitre/CVE-2020-25226.json",
          "summary": "CVE-2020-25226 Mitre 5.0 json"
        }
      ]
    }
  ]
}