Scalance Sc636-2c (Siemens) - vulnerabilities (CVEs)
15 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-05-12. Vendor: Siemens.
CVEs of Scalance Sc636-2c
- CVE-2025-40833 - CVSS 8.7 (high), 2026-05-12: The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause…
- CVE-2025-15467 - CVSS 9.8 (critical), 2026-01-27: Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact…
- CVE-2025-23384 - CVSS 6.3 (medium), 2025-03-11: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM…
- CVE-2024-3596 - CVSS 9 (critical), 2024-07-09: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or…
- CVE-2022-46144 - CVSS 7.1 (high), 2022-12-13: A vulnerability has been identified in SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions < V2.3), SCALANCE SC622-2C (6GK5622-2GS00-2AC2) (All versions >=…
- CVE-2022-46143 - CVSS 5.1 (medium), 2022-12-13: Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially…
- CVE-2022-46142 - CVSS 5.7 (medium), 2022-12-13: Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the…
- CVE-2022-46140 - CVSS 7.1 (high), 2022-12-13: Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file…
- CVE-2022-31765 - CVSS 8.8 (high), 2022-10-11: Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their…
- CVE-2022-36323 - CVSS 9.1 (critical), 2022-08-10: Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or…
- CVE-2022-36325 - CVSS 6.8 (medium), 2022-08-10: Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with…
- CVE-2022-36324 - CVSS 7.5 (high), 2022-08-10: Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute…
- CVE-2022-34821 - CVSS 9.8 (critical), 2022-07-12: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2), SCALANCE M804PB…
- CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
- CVE-2021-3712 - CVSS 7.4 (high), 2021-08-24: ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the…
