CVE-2022-46353

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions < V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions < V3.2.7). The webserver of affected devices calculates session ids and nonces in an insecure manner. This could allow an unauthenticated remote attacker to brute-force session ids and hijack existing sessions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-330

Affected software

Vendor	Product	Versions
Siemens	SCALANCE X204RNA (HSR)	All versions < V3.2.7
Siemens	SCALANCE X204RNA (PRP)	All versions < V3.2.7
Siemens	SCALANCE X204RNA EEC (HSR)	All versions < V3.2.7
Siemens	SCALANCE X204RNA EEC (PRP)	All versions < V3.2.7
Siemens	SCALANCE X204RNA EEC (PRP/HSR)	All versions < V3.2.7

References

https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdfPatch, Vendor Advisory

Timeline

Published: Dec 13, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-463545.3A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALA CVE-2022-463557.5A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions < V3.2.7), SCALANCE X204RNA (PRP) (All versions < V3.2.7), SCALA CVE-2022-463568.8Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and CVE-2022-463578.8Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and CVE-2022-463588.8Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and CVE-2022-463598.8Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and CVE-2022-46367.5Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to pat CVE-2022-463607.8Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the inform CVE-2022-463616.8An attacker having physical access to WDM can plug USB device to gain access and execute unwanted commands. A malicious user could enter a s CVE-2022-463637.5A vulnerability in Apache CXF before versions 3.5.5 and 3.4.10 allows an attacker to perform a remote directory listing or code exfiltration CVE-2022-463649.8A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows CVE-2022-463659.1Apache StreamPark 1.0.0 before 2.0.0 When the user successfully logs in, to modify his profile, the username will be passed to the server-la