Skip to content
Fencer Vulns
critical 9.8

CVE-2022-26647 json

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE…

published 2022-07-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-31201

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.

Patch / fix

  • siemens scalance_x204-2_firmware 5.2.6
  • siemens scalance_x204-2fm_firmware 5.2.6
  • siemens scalance_x204-2ld_firmware 5.2.6
  • siemens scalance_x204-2ld_ts_firmware 5.2.6
  • siemens scalance_x204-2ts_firmware 5.2.6
  • siemens scalance_x206-1_firmware 5.2.6
  • siemens scalance_x206-1ld_firmware 5.2.6
  • siemens scalance_x208_firmware 5.2.6
  • siemens scalance_x208_pro_firmware 5.2.6
  • siemens scalance_x212-2_firmware 5.2.6
  • siemens scalance_x212-2ld_firmware 5.2.6
  • siemens scalance_x216_firmware 5.2.6
  • siemens scalance_x224_firmware 5.2.6
  • siemens scalance_xf204_firmware 5.2.6
  • siemens scalance_xf204-2_firmware 5.2.6
  • siemens scalance_xf206-1_firmware 5.2.6
  • siemens scalance_xf208_firmware 5.2.6

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-22-195-01 updated cvss 8.8

Siemens SCALANCE X Switch Devices

  • Siemens SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) <V5.5.2 Siemens SCALANCE X201-3P IRT (6GK5201-3BH00-2BA3) <V5.5.2 Siemens SCALANCE X201-3P IRT PRO (6GK5201-3JR00-2BA6) <V5.5.2 Siemens SCALANCE X202-2IRT (6GK5202-2BB00-2BA3) <V5.5.2 Siemens SCALANCE X202-2IRT (6GK5202-2BB10-2BA3) <V5.5.2 Siemens SCALANCE X202-2P IRT (6GK5202-2BH00-2BA3) <V5.5.2
    +1 more products
    Siemens SCALANCE X202-2P IRT PRO (6GK5202-2JR00-2BA6) <V5.5.2
    affected: fixed in V5.5.2, workaround support.industry.siemens.com
  • Siemens SCALANCE X204-2 (6GK5204-2BB10-2AA3) <V5.2.6 Siemens SCALANCE X204-2FM (6GK5204-2BB11-2AA3) <V5.2.6 Siemens SCALANCE X204-2LD (6GK5204-2BC10-2AA3) <V5.2.6 Siemens SCALANCE X204-2LD TS (6GK5204-2BC10-2CA2) <V5.2.6 Siemens SCALANCE X204-2TS (6GK5204-2BB10-2CA2) <V5.2.6
    affected: fixed in V5.2.6, workaround support.industry.siemens.com
  • Siemens SCALANCE X204IRT (6GK5204-0BA00-2BA3) <V5.5.2 Siemens SCALANCE X204IRT (6GK5204-0BA10-2BA3) <V5.5.2 Siemens SCALANCE X204IRT PRO (6GK5204-0JA00-2BA6) <V5.5.2
    affected: fixed in V5.5.2, workaround support.industry.siemens.com
  • Siemens SCALANCE X206-1 (6GK5206-1BB10-2AA3) <V5.2.6 Siemens SCALANCE X206-1LD (6GK5206-1BC10-2AA3) <V5.2.6 Siemens SCALANCE X208 (6GK5208-0BA10-2AA3) <V5.2.6 Siemens SCALANCE X208PRO (6GK5208-0HA10-2AA6) <V5.2.6 Siemens SCALANCE X212-2 (6GK5212-2BB00-2AA3) <V5.2.6 Siemens SCALANCE X212-2LD (6GK5212-2BC00-2AA3) <V5.2.6
    +2 more products
    Siemens SCALANCE X216 (6GK5216-0BA00-2AA3) <V5.2.6 Siemens SCALANCE X224 (6GK5224-0BA00-2AA3) <V5.2.6
    affected: fixed in V5.2.6, workaround support.industry.siemens.com
  • Siemens SCALANCE XF201-3P IRT (6GK5201-3BH00-2BD2) <V5.5.2 Siemens SCALANCE XF202-2P IRT (6GK5202-2BH00-2BD2) <V5.5.2
    affected: fixed in V5.5.2, workaround support.industry.siemens.com
  • Siemens SCALANCE XF204 (6GK5204-0BA00-2AF2) <V5.2.6 Siemens SCALANCE XF204-2 (6GK5204-2BC00-2AF2) <V5.2.6
    affected: fixed in V5.2.6, workaround support.industry.siemens.com
  • Siemens SCALANCE XF204-2BA IRT (6GK5204-2AA00-2BD2) <V5.5.2 Siemens SCALANCE XF204IRT (6GK5204-0BA00-2BF2) <V5.5.2
    affected: fixed in V5.5.2, workaround support.industry.siemens.com
  • Siemens SCALANCE XF206-1 (6GK5206-1BC00-2AF2) <V5.2.6 Siemens SCALANCE XF208 (6GK5208-0BA00-2AF2) <V5.2.6
    affected: fixed in V5.2.6, workaround support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
18 mo ago

Exploit prediction

1.17% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Siemens SCALANCE X200-4P IRT
  • Siemens SCALANCE X201-3P IRT
  • Siemens SCALANCE X201-3P IRT PRO
  • Siemens SCALANCE X202-2IRT
  • Siemens SCALANCE X202-2P IRT
  • Siemens SCALANCE X202-2P IRT PRO
  • Siemens SCALANCE X204-2
  • Siemens SCALANCE X204-2FM
  • Siemens SCALANCE X204-2LD
  • Siemens SCALANCE X204-2LD TS
  • Siemens SCALANCE X204-2TS
  • Siemens SCALANCE X204IRT
  • Siemens SCALANCE X204IRT PRO
  • Siemens SCALANCE X206-1
  • Siemens SCALANCE X206-1LD
  • Siemens SCALANCE X208
  • Siemens SCALANCE X208PRO
  • Siemens SCALANCE X212-2
  • Siemens SCALANCE X212-2LD
  • Siemens SCALANCE X216
  • Siemens SCALANCE X224
  • Siemens SCALANCE XF201-3P IRT
  • Siemens SCALANCE XF202-2P IRT
  • Siemens SCALANCE XF204
  • Siemens SCALANCE XF204-2
  • Siemens SCALANCE XF204-2BA IRT
  • Siemens SCALANCE XF204IRT
  • Siemens SCALANCE XF206-1
  • Siemens SCALANCE XF208

Classification

Weakness
  • CWE-330 Use of Insufficiently Random Values

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.