Scalance Xc208g (Siemens) - vulnerabilities (CVEs)
14 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2024-07-09. Vendor: Siemens.
CVEs of Scalance Xc208g
- CVE-2024-3596 - CVSS 9 (critical), 2024-07-09: RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or…
- CVE-2023-44321 - CVSS 6.5 (medium), 2023-11-14: Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing an authenticated…
- CVE-2023-44318 - CVSS 6.9 (medium), 2023-11-14: Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated…
- CVE-2022-46140 - CVSS 7.1 (high), 2022-12-13: Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file…
- CVE-2022-46143 - CVSS 5.1 (medium), 2022-12-13: Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially…
- CVE-2022-46142 - CVSS 5.7 (medium), 2022-12-13: Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the…
- CVE-2022-31765 - CVSS 8.8 (high), 2022-10-11: Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their…
- CVE-2022-36324 - CVSS 7.5 (high), 2022-08-10: Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute…
- CVE-2022-36323 - CVSS 9.1 (critical), 2022-08-10: Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or…
- CVE-2022-36325 - CVSS 6.8 (medium), 2022-08-10: Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remote attacker with…
- CVE-2022-0778 - CVSS 7.5 (high), 2022-03-15: The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this…
- CVE-2020-28400 - CVSS 8.7 (high), 2021-07-13: Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be triggered…
- CVE-2019-6569 - CVSS 9.1 (critical), 2019-03-26: The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network. An attacker could…
- CVE-2017-12736 - CVSS 8.8 (high), 2017-12-26: After initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow an…
