CVE-2020-28391: Siemens Scalance x200-4pirt Firmware

Medium severity, CVSS 5.9. EPSS: 1.1% chance of exploitation in the next 30 days.

A vulnerability has been identified in SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.5), SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.5.0), SCALANCE X-200RNA switch family (All versions < V3.2.7). Devices create a new unique key upon factory reset, except when used with C-PLUG. When used with C-PLUG the devices use the hardcoded private RSA-key shipped with the firmware-image. An attacker could leverage this situation to a man-in-the-middle situation and decrypt previously captured traffic.

Affected products

  • Siemens Scalance x200-4pirt Firmware: before 5.5.0 (fixed in 5.5.0)
  • Siemens Scalance x201-3pirt Firmware: before 5.5.0 (fixed in 5.5.0)
  • Siemens Scalance x202-2irt Firmware: before 5.5.0 (fixed in 5.5.0)
  • Siemens Scalance x202-2pirt Firmware: before 5.5.0 (fixed in 5.5.0)
  • Siemens Scalance x202-2pirt Siplus Net Firmware: before 5.5.0 (fixed in 5.5.0)
  • Siemens Scalance x204irt Firmware: before 5.5.0 (fixed in 5.5.0)
  • Siemens Scalance x307-3 Firmware: any version
  • Siemens Scalance x307-3ld Firmware: any version
  • Siemens Scalance x308-2 Firmware: any version
  • Siemens Scalance x308-2ld Firmware: any version
  • Siemens Scalance x308-2lh+ Firmware: any version
  • Siemens Scalance x308-2lh Firmware: any version
  • Siemens Scalance x308-2m Firmware: any version
  • Siemens Scalance x308-2m Ts Firmware: any version
  • Siemens Scalance x310 Firmware: any version
  • Siemens Scalance x310fe Firmware: any version
  • Siemens Scalance x320-1fe Firmware: any version
  • Siemens Scalance x320-3ldfe Firmware: any version
  • Siemens Scalance XB205-3 Firmware: before 5.2.5 (fixed in 5.2.5)
  • Siemens Scalance XB205-3ld Firmware: before 5.2.5 (fixed in 5.2.5)
  • Siemens Scalance XB208 Firmware: before 5.2.5 (fixed in 5.2.5)
  • Siemens Scalance XB213-3 Firmware: before 5.2.5 (fixed in 5.2.5)
  • Siemens Scalance XB213-3ld Firmware: before 5.2.5 (fixed in 5.2.5)
  • Siemens Scalance XB216 Firmware: before 5.2.5 (fixed in 5.2.5)
  • Siemens Scalance XC206-2 Firmware: before 5.2.5 (fixed in 5.2.5)
  • and 41 more

Published 2021-01-12. Last modified 2026-06-17.