medium5.9
CVE-2020-28395
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl.
Impact
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Siemens | Scalance Xr324-12m Firmware | before 4.1.0 |
| Siemens | Scalance Xr324-12m Ts Firmware | before 4.1.0 |
| Siemens | Scalance Xr324-4m Eec Firmware | before 4.1.0 |
| Siemens | Scalance Xr324-4m Poe Firmware | before 4.1.0 |
| Siemens | Scalance Xr324-4m Poe Ts Firmware | before 4.1.0 |
| Siemens | Scalance Xr324wg Firmware | before 4.1.0 |
| Siemens | Scalance Xr326-2c Poe Wg Firmware | before 4.1.0 |
| Siemens | Scalance Xr328-4c Wg Firmware | before 4.1.0 |