Critical ICSA-22-195-01 3 CVEs

Siemens SCALANCE X Switch Devices

Published Jul 12, 2022 · Updated May 6, 2025 · Revision 3

Vendor: Siemens Product: SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) Product: SCALANCE X201-3P IRT (6GK5201-3BH00-2BA3) Product: SCALANCE X201-3P IRT PRO (6GK5201-3JR00-2BA6) Product: SCALANCE X202-2IRT (6GK5202-2BB00-2BA3) Product: SCALANCE X202-2IRT (6GK5202-2BB10-2BA3) Product: SCALANCE X202-2P IRT (6GK5202-2BH00-2BA3) Product: SCALANCE X202-2P IRT PRO (6GK5202-2JR00-2BA6) Product: SCALANCE X204-2 (6GK5204-2BB10-2AA3) Product: SCALANCE X204-2FM (6GK5204-2BB11-2AA3) Product: SCALANCE X204-2LD (6GK5204-2BC10-2AA3) Product: SCALANCE X204-2LD TS (6GK5204-2BC10-2CA2) Product: SCALANCE X204-2TS (6GK5204-2BB10-2CA2) Product: SCALANCE X204IRT (6GK5204-0BA00-2BA3) Product: SCALANCE X204IRT (6GK5204-0BA10-2BA3) Product: SCALANCE X204IRT PRO (6GK5204-0JA00-2BA6) Product: SCALANCE X206-1 (6GK5206-1BB10-2AA3) Product: SCALANCE X206-1LD (6GK5206-1BC10-2AA3) Product: SCALANCE X208 (6GK5208-0BA10-2AA3) Product: SCALANCE X208PRO (6GK5208-0HA10-2AA6) Product: SCALANCE X212-2 (6GK5212-2BB00-2AA3) Product: SCALANCE X212-2LD (6GK5212-2BC00-2AA3) Product: SCALANCE X216 (6GK5216-0BA00-2AA3) Product: SCALANCE X224 (6GK5224-0BA00-2AA3) Product: SCALANCE XF201-3P IRT (6GK5201-3BH00-2BD2) Product: SCALANCE XF202-2P IRT (6GK5202-2BH00-2BD2) Product: SCALANCE XF204 (6GK5204-0BA00-2AF2) Product: SCALANCE XF204-2 (6GK5204-2BC00-2AF2) Product: SCALANCE XF204-2BA IRT (6GK5204-2AA00-2BD2) Product: SCALANCE XF204IRT (6GK5204-0BA00-2BF2) +2 more

Summary

Several SCALANCE X switches contain multiple vulnerabilities. An unauthenticated attacker could reboot, cause denial-of-service conditions and potentially impact the system by other means through heap and buffer overflow vulnerabilities.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 3

Critical 9.6

CVE-2022-26649

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions…

Siemens SCALANCE X206-1 SCALANCE X201-3P IRT SCALANCE X204-2TS ICS / OT

Jul 12, 2022
High 8.8

CVE-2022-26647

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions…

Siemens SCALANCE X202-2P IRT PRO SCALANCE X206-1LD SCALANCE X204-2FM ICS / OT

Jul 12, 2022
High 8.2

CVE-2022-26648

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions…

Siemens SCALANCE X206-1LD SCALANCE X204-2FM SCALANCE X200-4P IRT ICS / OT

Jul 12, 2022

Revision history

2025-05-06 #3
Revision - Fixing typos
2023-04-11 #2
Added fix for SCALANCE X-200IRT switch family
2022-07-12 #1
Publication Date

References

SSA-310038: Multiple Vulnerabilities in SCALANCE X Switch Devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-310038.html
SSA-310038: Multiple Vulnerabilities in SCALANCE X Switch Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdf
SSA-310038: Multiple Vulnerabilities in SCALANCE X Switch Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-310038.txt
ICS Advisory ICSA-22-195-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B