{"id":"CVE-2022-46354","aliases":["EUVD-2022-49170","GHSA-9vcg-jgpf-m557"],"status":"published","title":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE...","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00721,"percentile":0.54295,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2022-12-13T00:00:00Z","modified":"2026-06-17T05:11:36Z","products":[{"vendor":"siemens","product":"6gk5204-0ba00-2kb2_firmware"},{"vendor":"siemens","product":"6gk5204-0ba00-2mb2_firmware"},{"vendor":"siemens","product":"6gk5204-0bs00-2na3_firmware"},{"vendor":"siemens","product":"6gk5204-0bs00-3la3_firmware"},{"vendor":"siemens","product":"6gk5204-0bs00-3pa3_firmware"},{"vendor":"siemens","product":"scalance x204rna (hsr)"},{"vendor":"siemens","product":"scalance x204rna (prp)"},{"vendor":"siemens","product":"scalance x204rna eec (hsr)"},{"vendor":"siemens","product":"scalance x204rna eec (prp)"},{"vendor":"siemens","product":"scalance x204rna eec (prp/hsr)"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-363821.pdf","tags":["x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-46354"},{"url":"https://github.com/advisories/GHSA-9vcg-jgpf-m557"}],"sources":{"cve":[{"id":"CVE-2022-46354","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-22T14:40:48.175Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:31.840191Z"}],"euvd":[{"id":"EUVD-2022-49170","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.","status":"published","published":"2022-12-13T00:00:00Z","modified":"2025-04-22T14:40:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:52:17.280298Z"}],"ghsa":[{"id":"GHSA-9vcg-jgpf-m557","title":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE...","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.","status":"published","published":"2022-12-13T18:30:34Z","modified":"2024-04-04T03:13:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:56:14.332077Z"}],"nvd":[{"id":"CVE-2022-46354","description":"A vulnerability has been identified in SCALANCE X204RNA (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (HSR) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP) (All versions \u003c V3.2.7), SCALANCE X204RNA EEC (PRP/HSR) (All versions \u003c V3.2.7). The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.","status":"published","published":"2022-12-13T16:15:25.917Z","modified":"2026-06-17T05:11:36.31Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:33.649381Z"}]}}