CVE-2020-28391 Hardcoded credentials in SCALANCE X-200 switch family (incl. SIPLUS NET variants)
Attackers can decrypt traffic via man-in-the-middle attacks on SCALANCE switches using C-PLUG due to hardcoded RSA keys.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28391?
CVE-2020-28391 is a medium-severity vulnerability in Siemens SCALANCE X-200 switch family (incl. SIPLUS NET variants), published on 12 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
Which versions are affected by CVE-2020-28391?
It affects 66 products.
Products include Siemens Scalance X200-4pirt Firmware, Siemens Scalance X201-3pirt Firmware, Siemens Scalance X202-2irt Firmware, Siemens Scalance X202-2pirt Firmware, Siemens Scalance X202-2pirt Siplus Net Firmware, Siemens Scalance X204irt Firmware and 60 more.
How do I fix CVE-2020-28391?
No fix has been published for CVE-2020-28391 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28391 being exploited?
There is no known exploitation of CVE-2020-28391 in the wild and no public exploit code.
Other vulnerabilities in Siemens SCALANCE X-200 switch family (incl. SIPLUS NET variants)
Sources
Also known as GHSA-pffp-ch4h-4669.