CVE-2022-46353

Summary

CVE	CVE-2022-46353
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-12-13 16:15:00 UTC
Updated	2022-12-16 14:47:00 UTC
Description	A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.

Risk And Classification

Problem Types: CWE-330

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Hardware	Siemens	6gk5204-0ba00-2kb2	-	All	All	All
Operating System	Siemens	6gk5204-0ba00-2kb2 Firmware	All	All	All	All
Hardware	Siemens	6gk5204-0ba00-2mb2	-	All	All	All
Operating System	Siemens	6gk5204-0ba00-2mb2 Firmware	All	All	All	All
Hardware	Siemens	6gk5204-0bs00-2na3	-	All	All	All
Operating System	Siemens	6gk5204-0bs00-2na3 Firmware	All	All	All	All
Hardware	Siemens	6gk5204-0bs00-3la3	-	All	All	All
Operating System	Siemens	6gk5204-0bs00-3la3 Firmware	All	All	All	All
Hardware	Siemens	6gk5204-0bs00-3pa3	-	All	All	All
Operating System	Siemens	6gk5204-0bs00-3pa3 Firmware	All	All	All	All

References

Reference	Source	Link	Tags
N/A	CONFIRM	cert-portal.siemens.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

591279 Siemens SCALANCE X-200RNA Switch Devices Denial of Service (DoS), Hijacking of web sessions Multiple Vulnerabilities (ICSA-22-349-02, SSA-363821)