CVE-2020-28395 Weak cryptography in SCALANCE X-200RNA switch family
Attackers can decrypt previously captured traffic and perform man-in-the-middle attacks because devices reuse private keys after factory resets.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-28395?
CVE-2020-28395 is a medium-severity vulnerability in Siemens SCALANCE X-200RNA switch family, published on 12 Jan 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in SCALANCE X-200RNA switch family (All versions < V3.2.7), SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants) (All versions < V4.1.0). Devices do not create a new unique private key after factory reset. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.
Which versions are affected by CVE-2020-28395?
It affects 8 products.
Products include Siemens Scalance Xr324-12m Firmware, Siemens Scalance Xr324-12m Ts Firmware, Siemens Scalance Xr324-4m Eec Firmware, Siemens Scalance Xr324-4m Poe Firmware, Siemens Scalance Xr324-4m Poe Ts Firmware, Siemens Scalance Xr324wg Firmware and 2 more.
How do I fix CVE-2020-28395?
No fix has been published for CVE-2020-28395 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-28395 being exploited?
There is no known exploitation of CVE-2020-28395 in the wild and no public exploit code.
Sources
Also known as GHSA-vfw8-4p7f-cjjh.