Siemens Scalance Xc-300/xr-300/xc-400/xr-500wg/xr-500 Family vulnerabilities

11 CVEs affecting Siemens Scalance Xc-300/xr-300/xc-400/xr-500wg/xr-500 Family, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-9232, published 2025-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-2511, published 2024-04-08. Medium severity, CVSS 5.9. EPSS: 52.4% chance of exploitation in the next 30 days. Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to…
CVE-2024-5535, published 2024-06-27. Critical severity, CVSS 9.1. EPSS: 5.6% chance of exploitation in the next 30 days. Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A…
CVE-2025-9231, published 2025-09-30. Medium severity, CVSS 6.5. EPSS: 2.2% chance of exploitation in the next 30 days. Issue summary: A timing side-channel which could potentially allow remote recovery of the private key exists in the SM2 algorithm implementation on 64 bit ARM platforms. Impact summary: A timing…
CVE-2025-9232, published 2025-09-30. Medium severity, CVSS 5.9. EPSS: 2% chance of exploitation in the next 30 days. Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority…
CVE-2025-9230, published 2025-09-30. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may…
CVE-2024-8176, published 2025-03-14. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references,…
CVE-2024-41996, published 2024-08-26. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Validating the order of the public keys in the Diffie-Hellman Key Agreement Protocol, when an approved safe prime is used, allows remote attackers (from the client side) to trigger unnecessarily…
CVE-2025-4373, published 2025-05-06. Medium severity, CVSS 4.8. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will…
CVE-2025-3360, published 2025-04-07. Low severity, CVSS 3.7. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601() function.
CVE-2025-6141, published 2025-06-16. Low severity, CVSS 3.3. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability has been found in GNU ncurses up to 6.5-20250322 and classified as problematic. This vulnerability affects the function postprocess_termcap of the file tinfo/parse_entry.c. The…

Latest

CVE-2025-1390, published 2025-02-18. Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days. The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This…