Skip to content
Fencer Vulns
high 8.6

CVE-2018-13807 json

A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All ver…

published 2018-09-12 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-5743

cvss
8.6
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.2%
EPSS 4.2% chance of exploitation in 30 days, percentile 90%
public exploits
0
none known

Summary

A vulnerability has been identified in SCALANCE X300 (All versions < V4.0.0), SCALANCE X408 (All versions < V4.0.0), SCALANCE X414 (All versions). The web interface on port 443/tcp could allow an attacker to cause a Denial-of-Service condition by sending specially crafted packets to the web server. The device will automatically reboot, impacting network availability for other devices. An attacker must have network access to port 443/tcp to exploit the vulnerability. Neither valid credentials nor interaction by a legitimate user is required to exploit the vulnerability. There is no confidentiality or integrity impact, only availability is temporarily impacted. This vulnerability could be triggered by publicly available tools.

Patch / fix

  • siemens scalance_x408_firmware 4.0.0
  • siemens scalance_x300_firmware 4.0.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-18-254-05 updated cvss 8.6

Siemens SCALANCE X Switches

  • Siemens SCALANCE X-300 switch family (incl. SIPLUS NET variants) <V4.0.0 Siemens SCALANCE X408 <V4.0.0
    affected: fixed in V4.1.2, mitigation
  • Siemens SCALANCE X414
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

4.18% chance of exploitation in the next 30 days, higher than 90% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD 2.0 7.8 AV:N/AC:L/Au:N/C:N/I:N/A:C

Affected products

  • Siemens AG SCALANCE X300, SCALANCE X408, SCALANCE X414

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.