CVE-2022-26649 Denial of service in SCALANCE X200-4P IRT

Q: Is CVE-2022-26649 being exploited?

There is no known exploitation of CVE-2022-26649 in the wild and no public exploit code.

Q: How do I fix CVE-2022-26649?

No fix has been published for CVE-2022-26649 yet. Limit exposure of the affected software until one is available.

Critical 9.6 Published 12 Jul 2022 Updated 21 Apr 2025

Unauthenticated remote attackers can crash Siemens SCALANCE industrial switches by sending malformed HTTP GET requests due to improper URI validation.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-26649?

CVE-2022-26649 is a critical denial of service vulnerability in Siemens SCALANCE X200-4P IRT, published on 12 Jul 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices.

Weakness: CWE-120

Which versions are affected by CVE-2022-26649?

It affects 29 products.

Products include Siemens Scalance X200-4p Irt Firmware, Siemens Scalance X201-3p Irt Firmware, Siemens Scalance X201-3p Irt Pro Firmware, Siemens Scalance X202-2irt Firmware, Siemens Scalance X202-2p Irt Firmware, Siemens Scalance X202-2p Irt Pro Firmware and 23 more.

How do I fix CVE-2022-26649?

No fix has been published for CVE-2022-26649 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-26649 being exploited?

There is no known exploitation of CVE-2022-26649 in the wild and no public exploit code.

Sources

Also known as GHSA-xf68-6h35-h4p2.