← Vulnerability feed

Vulnerability record · CVE-2020-28393 · published 12 May 2021

CVE-2020-28393: Siemens scalance xm-400 firmware vulnerability

Siemens · Scalance Xm 400 Firmware

An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).

7.5 CVSS 3.1 High EPSS 1.6% · top 24.2% CWE-682 · CWE-682
7.5CVSS 3.1 base score, v2 7.1
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
11Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

11 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-10 Third Party AdvisoryUS Government Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-116379.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-131-10 Third Party AdvisoryUS Government Resource

Track CVE-2020-28393 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2022-36323Siemens scalance m-800 firmware injection vulnerabilityAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject …EPSS 1.8%8.8CVE-2017-12736Siemens scalance xb-200 firmware insecure default initialization vulnerabilityAfter initial configuration, the Ruggedcom Discovery Protocol (RCDP) is still able to write to the device under certain conditions. This could allow …EPSS 1.1%7.5CVE-2022-36324Siemens scalance m-800 firmware allocation without limits vulnerabilityAffected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TC…EPSS 1.7%7.5CVE-2021-37182Siemens scalance xm408-4c firmware vulnerabilityA vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.) (All versions < V6.5), SCALANCE XM408-8C …EPSS 0.63%7.5CVE-2019-13946Siemens dk standard ethernet controller uncontrolled resource consumption vulnerabilityProfinet-IO (PNIO) stack versions prior V06.00 do not properly limit internal resource allocation when multiple legitimate diagnostic package request…EPSS 1.5%7.1CVE-2022-46140Siemens ruggedcom rm1224 lte\(4g\) eu firmware broken cryptographic algorithm vulnerabilityAffected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of th…EPSS 0.25%5.9CVE-2021-3449OpenSSL TLS server NULL pointer dereference via renegotiation ClientHelloAn OpenSSL TLS server can be crashed by a maliciously crafted TLSv1.2 renegotiation ClientHello that omits the signature_algorithms extension while i…EPSS 64%analysed5.2CVE-2022-46142Siemens ruggedcom rm1224 lte\(4g\) eu firmware insufficiently protected credentials vulnerabilityAffected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and dec…EPSS 0.27%

Source: NIST National Vulnerability Database (record CVE-2020-28393), CISA KEV, FIRST EPSS (scores of 2026-10-15). This page is refreshed as NVD updates the record.