CVE-2022-26649

A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT PRO (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2IRT (All versions < V5.5.2), SCALANCE X202-2P IRT (All versions < V5.5.2), SCALANCE X202-2P IRT PRO (All versions < V5.5.2), SCALANCE X204-2 (All versions < V5.2.6), SCALANCE X204-2FM (All versions < V5.2.6), SCALANCE X204-2LD (All versions < V5.2.6), SCALANCE X204-2LD TS (All versions < V5.2.6), SCALANCE X204-2TS (All versions < V5.2.6), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT (All versions < V5.5.2), SCALANCE X204IRT PRO (All versions < V5.5.2), SCALANCE X206-1 (All versions < V5.2.6), SCALANCE X206-1LD (All versions < V5.2.6), SCALANCE X208 (All versions < V5.2.6), SCALANCE X208PRO (All versions < V5.2.6), SCALANCE X212-2 (All versions < V5.2.6), SCALANCE X212-2LD (All versions < V5.2.6), SCALANCE X216 (All versions < V5.2.6), SCALANCE X224 (All versions < V5.2.6), SCALANCE XF201-3P IRT (All versions < V5.5.2), SCALANCE XF202-2P IRT (All versions < V5.5.2), SCALANCE XF204 (All versions < V5.2.6), SCALANCE XF204-2 (All versions < V5.2.6), SCALANCE XF204-2BA IRT (All versions < V5.5.2), SCALANCE XF204IRT (All versions < V5.5.2), SCALANCE XF206-1 (All versions < V5.2.6), SCALANCE XF208 (All versions < V5.2.6). Affected devices do not properly validate the URI of incoming HTTP GET requests. This could allow an unauthenticated remote attacker to crash affected devices.

• CWE-120
• CWE-120

• https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdfPatch, Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-310038.pdfPatch, Vendor Advisory

Published

Jul 12, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-26643An issue in EasyIO CPT Graphics v0.8 allows attackers to dis…5.3
• CVE-2022-26644Online Banking System Protect v1.0 was discovered to contain…6.1
• CVE-2022-26645A remote code execution (RCE) vulnerability in Online Bankin…9.8
• CVE-2022-26646Online Banking System Protect v1.0 was discovered to contain…9.8
• CVE-2022-26647A vulnerability has been identified in SCALANCE X200-4P IRT …8.8
• CVE-2022-26648A vulnerability has been identified in SCALANCE X200-4P IRT …8.2
• CVE-2022-2665A vulnerability classified as critical was found in SourceCo…8.8
• CVE-2022-26650In Apache ShenYui, ShenYu-Bootstrap, RegexPredicateJudge.jav…7.5
• CVE-2022-26651An issue was discovered in Asterisk through 19.x and Certifi…9.8
• CVE-2022-26652NATS nats-server before 2.7.4 allows Directory Traversal (wi…6.5
• CVE-2022-26653Zoho ManageEngine Remote Access Plus before 10.1.2137.15 all…5.3
• CVE-2022-26654Pexip Infinity before 27.3 allows remote attackers to force …7.5