CVE-2020-28393

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-12 · updated 2026-06-17
Weakness: CWE-682

Description

An unauthenticated remote attacker could create a permanent denial-of-service condition by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device on the SCALANCE XM-400, XR-500 (All versions prior to v6.4).

Affected products

Siemens Scalance Xm-400 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xm408-4C Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xm408-4C L3 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xm408-8C Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xm408-8C L3 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xm416-4C Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xm416-4C L3 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xr524 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xr526 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xr528 Firmware: before 6.4 — fixed in 6.4
Siemens Scalance Xr552 Firmware: before 6.4 — fixed in 6.4

How to fix

Upgrade to a fixed version: Siemens Scalance Xm-400 Firmware 6.4; Siemens Scalance Xm408-4C Firmware 6.4; Siemens Scalance Xm408-4C L3 Firmware 6.4; Siemens Scalance Xm408-8C Firmware 6.4; Siemens Scalance Xm408-8C L3 Firmware 6.4; Siemens Scalance Xm416-4C Firmware 6.4; Siemens Scalance Xm416-4C L3 Firmware 6.4; Siemens Scalance Xr524 Firmware 6.4; Siemens Scalance Xr526 Firmware 6.4; Siemens Scalance Xr528 Firmware 6.4; Siemens Scalance Xr552 Firmware 6.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-28393 or the next vulnerability affects your stack