Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-26647

CVSS 8.8 · High EPSS 1.48% · P81
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-26647

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用不充分的随机数
Source: NVD (National Vulnerability Database)
Vulnerability Title
Siemens SCALANCE 安全特征问题特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Siemens SCALANCE是德国西门子（Siemens）公司的一系列以太网交换机。可连接到工业控制系统 (ICS) 设备，包括可编程逻辑控制器 (PLC) 和人机界面 (HMI) 系统。 Siemens SCALANCE 多款产品存在安全特征问题漏洞，该漏洞源于以不安全的方式计算会话 ID 和随机数。以下产品及版本受到影响：SCALANCE X204IRT PRO所有版本、SCALANCE X206-1 V5.2.6之前版本、SCALANCE X206-1LD V5.2.6之前版本、SCALANCE
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
SiemensSCALANCE X200-4P IRT All versions < V5.5.2 -
SiemensSCALANCE X201-3P IRT All versions < V5.5.2 -
SiemensSCALANCE X201-3P IRT PRO All versions < V5.5.2 -
SiemensSCALANCE X202-2IRT All versions < V5.5.2 -
SiemensSCALANCE X202-2IRT All versions < V5.5.2 -
SiemensSCALANCE X202-2P IRT All versions < V5.5.2 -
SiemensSCALANCE X202-2P IRT PRO All versions < V5.5.2 -
SiemensSCALANCE X204-2 All versions < V5.2.6 -
SiemensSCALANCE X204-2FM All versions < V5.2.6 -
SiemensSCALANCE X204-2LD All versions < V5.2.6 -
SiemensSCALANCE X204-2LD TS All versions < V5.2.6 -
SiemensSCALANCE X204-2TS All versions < V5.2.6 -
SiemensSCALANCE X204IRT All versions < V5.5.2 -
SiemensSCALANCE X204IRT All versions < V5.5.2 -
SiemensSCALANCE X204IRT PRO All versions < V5.5.2 -
SiemensSCALANCE X206-1 All versions < V5.2.6 -
SiemensSCALANCE X206-1LD All versions < V5.2.6 -
SiemensSCALANCE X208 All versions < V5.2.6 -
SiemensSCALANCE X208PRO All versions < V5.2.6 -
SiemensSCALANCE X212-2 All versions < V5.2.6 -
SiemensSCALANCE X212-2LD All versions < V5.2.6 -
SiemensSCALANCE X216 All versions < V5.2.6 -
SiemensSCALANCE X224 All versions < V5.2.6 -
SiemensSCALANCE XF201-3P IRT All versions < V5.5.2 -
SiemensSCALANCE XF202-2P IRT All versions < V5.5.2 -
SiemensSCALANCE XF204 All versions < V5.2.6 -
SiemensSCALANCE XF204-2 All versions < V5.2.6 -
SiemensSCALANCE XF204-2BA IRT All versions < V5.5.2 -
SiemensSCALANCE XF204IRT All versions < V5.5.2 -
SiemensSCALANCE XF206-1 All versions < V5.2.6 -
SiemensSCALANCE XF208 All versions < V5.2.6 -

II. Public POCs for CVE-2022-26647

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-26647

请登录查看更多情报信息。

Same Patch Batch · Siemens · 2022-07-12 · 41 CVEs total

CVE-2022-3481910.0 CRITICAL多款Siemens产品缓冲区错误漏洞
CVE-2022-266499.6 CRITICAL多款Siemens SCALANCE产品安全漏洞
CVE-2022-348208.4 HIGH多款Siemens SIMATIC产品命令注入漏洞
CVE-2022-266488.2 HIGHSiemens SCALANCE 安全漏洞
CVE-2022-346638.0 HIGHSiemens RUGGEDCOM 代码注入漏洞
CVE-2022-348217.6 HIGHSiemens SIMATIC 代码注入漏洞
CVE-2022-344646.3 MEDIUMSiemens SICAM GridEdge Essential 安全漏洞
CVE-2022-34275Siemens PADS Standard/Plus Viewer 缓冲区错误漏洞
CVE-2022-34748Siemens Simcenter Femap 缓冲区错误漏洞
CVE-2022-34274Siemens PADS Standard/Plus Viewer 缓冲区错误漏洞
CVE-2022-34273Siemens PADS Standard/Plus Viewer 缓冲区错误漏洞
CVE-2022-34272Siemens PADS Standard/Plus Viewer 缓冲区错误漏洞
CVE-2022-33736Siemens Opcenter Quality 授权问题漏洞
CVE-2022-33138Siemens SIMATIC 访问控制错误漏洞
CVE-2022-33137Siemens SIMATIC 代码问题漏洞
CVE-2022-31257Siemens Mendix Applications using Mendix 7和Siemens Mendix Applications using Mendix 9 安全漏洞
CVE-2022-30938Siemens EN100 Ethernet module 缓冲区错误漏洞
CVE-2022-29884Siemens SICAM A8000 CP-8000 资源管理错误漏洞
CVE-2022-29560Siemens RUGGEDCOM ROX 系列命令注入漏洞
CVE-2022-34466Siemens Mendix Applications using Mendix 9 注入漏洞

Showing top 20 of 41 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: SCALANCE X200-4P IRT
Same vendor: Siemens
Same weakness: CWE-330

V. Comments for CVE-2022-26647

No comments yet

Leave a comment