What’s Vulnerable › Vulnerabilities

CVE-2020-28391

• Severity: medium (CVSS 5.9 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-12 · updated 2026-06-17
• Weakness: CWE-321

Description

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

Affected products

• Siemens Scalance X200-4Pirt Firmware: before 5.5.0 — fixed in 5.5.0
• Siemens Scalance X201-3Pirt Firmware: before 5.5.0 — fixed in 5.5.0
• Siemens Scalance X202-2Irt Firmware: before 5.5.0 — fixed in 5.5.0
• Siemens Scalance X202-2Pirt Firmware: before 5.5.0 — fixed in 5.5.0
• Siemens Scalance X202-2Pirt Siplus Net Firmware: before 5.5.0 — fixed in 5.5.0
• Siemens Scalance X204Irt Firmware: before 5.5.0 — fixed in 5.5.0
• Siemens Scalance X307-3 Firmware: all versions
• Siemens Scalance X307-3Ld Firmware: all versions
• Siemens Scalance X308-2 Firmware: all versions
• Siemens Scalance X308-2Ld Firmware: all versions
• Siemens Scalance X308-2Lh+ Firmware: all versions
• Siemens Scalance X308-2Lh Firmware: all versions
• Siemens Scalance X308-2M Firmware: all versions
• Siemens Scalance X308-2M Ts Firmware: all versions
• Siemens Scalance X310 Firmware: all versions
• Siemens Scalance X310Fe Firmware: all versions
• Siemens Scalance X320-1Fe Firmware: all versions
• Siemens Scalance X320-3Ldfe Firmware: all versions
• Siemens Scalance Xb205-3 Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xb205-3Ld Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xb208 Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xb213-3 Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xb213-3Ld Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xb216 Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xc206-2 Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xc206-2G Poe Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xc206-2G Poe Eec Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xc206-2Sfp Eec Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xc206-2Sfp Firmware: before 5.2.5 — fixed in 5.2.5
• Siemens Scalance Xc206-2Sfp G (E/Ip) Firmware: before 5.2.5 — fixed in 5.2.5

How to fix

Upgrade to a fixed version: Siemens Scalance X200-4Pirt Firmware 5.5.0; Siemens Scalance X201-3Pirt Firmware 5.5.0; Siemens Scalance X202-2Irt Firmware 5.5.0; Siemens Scalance X202-2Pirt Firmware 5.5.0; Siemens Scalance X202-2Pirt Siplus Net Firmware 5.5.0; Siemens Scalance X204Irt Firmware 5.5.0; Siemens Scalance Xb205-3 Firmware 5.2.5; Siemens Scalance Xb205-3Ld Firmware 5.2.5; Siemens Scalance Xb208 Firmware 5.2.5; Siemens Scalance Xb213-3 Firmware 5.2.5; Siemens Scalance Xb213-3Ld Firmware 5.2.5; Siemens Scalance Xb216 Firmware 5.2.5. Check the vendor advisory for mitigations.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02
• https://cert-portal.siemens.com/productcert/pdf/ssa-274900.pdf
• https://us-cert.cisa.gov/ics/advisories/icsa-21-012-02

Get alerted when CVE-2020-28391 or the next vulnerability affects your stack