CVE-2022-26334

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-12 · updated 2026-06-17
Weakness: CWE-120

Description

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. Affected devices do not properly validate the GET parameter XNo of incoming HTTP requests. This could allow an unauthenticated remote attacker to crash affected devices.

Affected products

Siemens Scalance X302-7Eec Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X304-2Fe Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X306-1Ldfe Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X307-2Eec Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X307-3 Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X307-3Ld Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X308-2 Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X308-2Ld Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X308-2Lh+ Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X308-2Lh Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X308-2M Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X308-2M Poe Firmware: all versions
Siemens Scalance X308-2M Ts Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X310 Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X310Fe Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X320-1-2Ldfe Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X320-1Fe Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance X408-2 Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance Xr324-12M Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance Xr324-12M Ts Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance Xr324-4M Eec Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance Xr324-4M Poe Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Scalance Xr324-4M Poe Ts Firmware: before 4.1.4 — fixed in 4.1.4
Siemens Siplus Net Scalance X308-2 Firmware: before 4.1.4 — fixed in 4.1.4

How to fix

Upgrade to a fixed version: Siemens Scalance X302-7Eec Firmware 4.1.4; Siemens Scalance X304-2Fe Firmware 4.1.4; Siemens Scalance X306-1Ldfe Firmware 4.1.4; Siemens Scalance X307-2Eec Firmware 4.1.4; Siemens Scalance X307-3 Firmware 4.1.4; Siemens Scalance X307-3Ld Firmware 4.1.4; Siemens Scalance X308-2 Firmware 4.1.4; Siemens Scalance X308-2Ld Firmware 4.1.4; Siemens Scalance X308-2Lh+ Firmware 4.1.4; Siemens Scalance X308-2Lh Firmware 4.1.4; Siemens Scalance X308-2M Firmware 4.1.4; Siemens Scalance X308-2M Ts Firmware 4.1.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-26334 or the next vulnerability affects your stack