Siemens Scalance x308-2m vulnerabilities

2 CVEs affecting Siemens Scalance x308-2m, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-40833, published 2026-05-12.

More from Siemens.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2012-1802, published 2012-04-18. High severity, CVSS 7.8. EPSS: 6.1% chance of exploitation in the next 30 days. Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300…
• CVE-2025-40833, published 2026-05-12. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual…