Skip to content
OpenAdvisories
High SSA-130874 1 CVE

SSA-130874: Buffer Overflow Vulnerability in SCALANCE X Switches

Published Apr 5, 2012 · Updated Feb 10, 2026 · Revision 3

Vendor: Siemens Product: SCALANCE X302-7 EEC (230V coated) (6GK5302-7GD00-3GA3) Product: SCALANCE X302-7 EEC (230V) (6GK5302- 7GD00-3EA3) Product: SCALANCE X302-7 EEC (24V coated) (6GK5302-7GD00-1GA3) Product: SCALANCE X302-7 EEC (24V) (6GK5302-7GD00-1EA3) Product: SCALANCE X302-7 EEC (2x 230V coated) (6GK5302-7GD00-4GA3) Product: SCALANCE X302-7 EEC (2x 230V) (6GK5302-7GD00-4EA3) Product: SCALANCE X302-7 EEC (2x 24V coated) (6GK5302-7GD00-2GA3) Product: SCALANCE X302-7 EEC (2x 24V) (6GK5302-7GD00-2EA3) Product: SCALANCE X304-2FE (6GK5304-2BD00-2AA3) Product: SCALANCE X306-1LD FE (6GK5306-1BF00-2AA3) Product: SCALANCE X307-2 EEC (230V coated) (6GK5307-2FD00-3GA3) Product: SCALANCE X307-2 EEC (230V) (6GK5307-2FD00-3EA3) Product: SCALANCE X307-2 EEC (24V coated) (6GK5307-2FD00-1GA3) Product: SCALANCE X307-2 EEC (24V) (6GK5307-2FD00-1EA3) Product: SCALANCE X307-2 EEC (2x 230V coated) (6GK5307-2FD00-4GA3) Product: SCALANCE X307-2 EEC (2x 230V) (6GK5307-2FD00-4EA3) Product: SCALANCE X307-2 EEC (2x 24V coated) (6GK5307-2FD00-2GA3) Product: SCALANCE X307-2 EEC (2x 24V) (6GK5307-2FD00-2EA3) Product: SCALANCE X307-3 (6GK5307-3BL00-2AA3) Product: SCALANCE X307-3 (6GK5307-3BL10-2AA3) Product: SCALANCE X307-3LD (6GK5307-3BM00-2AA3) Product: SCALANCE X307-3LD (6GK5307-3BM10-2AA3) Product: SCALANCE X308-2 (6GK5308-2FL00-2AA3) Product: SCALANCE X308-2 RD (inkl. SIPLUS variants) Product: SCALANCE X308-2LD (6GK5308-2FM00-2AA3) Product: SCALANCE X308-2LD (6GK5308-2FM10-2AA3) Product: SCALANCE X308-2LH (6GK5308-2FN00-2AA3) Product: SCALANCE X308-2LH (6GK5308-2FN10-2AA3) Product: SCALANCE X308-2LH+ (6GK5308-2FP00-2AA3) +49 more

Summary

The embedded web server on affected devices contains a buffer overflow vulnerability. This could allow remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.

Siemens has released new versions for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

  • Unscored —
    CVE-2012-1802

    Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X…

Revision history

  1. #5

    Used CVE ID (CVE-2012-1802) instead of the deprecated SVE ID (SVE-2012-0002); Corrected CVSS vector and added mitigation information; Updated SSA to current data model and support of csaf

  2. #4

    SIPLUS devices now explicitly mentioned in the list of affected products

  3. #3

    Publication Date

References