← Vulnerability feed

Vulnerability record · CVE-2020-28395 · published 12 January 2021

CVE-2020-28395: Siemens scalance xr324-12m firmware hard-coded credentials vulnerability

Siemens · Scalance Xr324 12m Firmware

A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

5.9 CVSS 3.1 Medium EPSS 1.2% · top 32.6% CWE-321 · CWE-321CWE-798 · Hard-coded credentials
5.9CVSS 3.1 base score, v2 4.3
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
8Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02 Third Party AdvisoryUS Government ResourceVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf Vendor Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02 Third Party AdvisoryUS Government ResourceVendor Advisory

Track CVE-2020-28395 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-25752Siemens scalance x302-7eec firmware vulnerabilityA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC…EPSS 1.5%9.1CVE-2022-36323Siemens scalance m-800 firmware injection vulnerabilityAffected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject …EPSS 1.8%8.8CVE-2022-25754Siemens scalance x302-7eec firmware cross-site request forgery vulnerabilityA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC…EPSS 0.53%8.8CVE-2022-25753Siemens scalance x302-7eec firmware stack-based buffer overflow vulnerabilityA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC…EPSS 1.7%8.7CVE-2020-28400Siemens dk standard ethernet controller evaluation kit firmware allocation without limits vulnerabilityAffected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial of service condition. The vulnerability can be t…EPSS 1.9%7.5CVE-2022-36324Siemens scalance m-800 firmware allocation without limits vulnerabilityAffected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TC…EPSS 1.7%7.5CVE-2022-26380Siemens scalance x302-7eec firmware out-of-bounds read vulnerabilityA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC…EPSS 0.95%7.5CVE-2022-26334Siemens scalance x302-7eec firmware classic buffer overflow vulnerabilityA vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC…EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2020-28395), CISA KEV, FIRST EPSS (scores of 2026-10-15). This page is refreshed as NVD updates the record.