CVE-2023-29054: scalance x200-4p irt firmware before 5.5.2 (exclusive); +25 more affected products

Affected technology

scalance x200-4p irt firmware · before 5.5.2 (exclusive)
siemens

scalance x201-3p irt firmware · before 5.5.2 (exclusive)
siemens

scalance x201-3p irt pro firmware · before 5.5.2 (exclusive)
siemens

scalance x202-2irt firmware · before 5.5.2 (exclusive)
siemens

scalance x202-2p irt firmware · before 5.5.2 (exclusive)
siemens

scalance x202-2p irt pro firmware · before 5.5.2 (exclusive)
siemens

scalance x204irt firmware · before 5.5.2 (exclusive)
siemens

scalance x204irt pro firmware · before 5.5.2 (exclusive)
siemens

scalance xf201-3p irt firmware · before 5.5.2 (exclusive)
siemens

scalance xf202-2p irt firmware · before 5.5.2 (exclusive)
siemens

scalance xf204-2ba irt firmware · before 5.5.2 (exclusive)
siemens

scalance xf204irt firmware · before 5.5.2 (exclusive)
siemens

siplus net scalance x202-2p irt firmware · before 5.5.2 (exclusive)
siemens

SCALANCE X200-4P IRT · All versions < V5.5.2
Siemens

SCALANCE X201-3P IRT · All versions < V5.5.2
Siemens

SCALANCE X201-3P IRT PRO · All versions < V5.5.2
Siemens

SCALANCE X202-2IRT · All versions < V5.5.2
Siemens

SCALANCE X202-2P IRT · All versions < V5.5.2
Siemens

SCALANCE X202-2P IRT PRO · All versions < V5.5.2
Siemens

SCALANCE X204IRT · All versions < V5.5.2
Siemens

SCALANCE X204IRT PRO · All versions < V5.5.2
Siemens

SCALANCE XF201-3P IRT · All versions < V5.5.2
Siemens

SCALANCE XF202-2P IRT · All versions < V5.5.2
Siemens

SCALANCE XF204-2BA IRT · All versions < V5.5.2
Siemens

SCALANCE XF204IRT · All versions < V5.5.2
Siemens

SIPLUS NET SCALANCE X202-2P IRT · All versions < V5.5.2
Siemens

Description’s affected range: versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Adjacent network · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 3.1 assessment (base score 6.7/10) rates confidentiality impact as low; integrity and availability impact as high. NVD’s CVSS 3.1 assessment (base score 7.4/10) rates confidentiality and integrity impact as high; availability impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.