CVE:CVE-2020-28395
CNNVD:CNNVD-202101-830
Siemens SCALANCE是德国西门子（Siemens）公司的一系列以太网交换机。可连接到工业控制系统 (ICS) 设备，包括可编程逻辑控制器 (PLC) 和人机界面 (HMI) 系统。
Siemens SCALANCE 中存在信任管理问题漏洞，攻击者可利用该漏洞捕获流量。以下产品及版本受到影响：SCALANCE X-200、SCALANCE X-200IRT、SCALANCE X-300 4.1.0之前。
solution:Upgrade siemens scalance_xr324-12m_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr324-12m_ts_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr324-4m_eec_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr324-4m_poe_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr324-4m_poe_ts_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr324wg_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr326-2c_poe_wg_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0); Upgrade siemens scalance_xr328-4c_wg_firmware to a higher version than 4.1.0,and avoid the version (,4.1.0)