Missing security headers may expose session information in Siemens SCALANCE X-300 switches

A vulnerability has been identified in SCALANCE X302-7 EEC (230V), SCALANCE X302-7 EEC (230V, coated), SCALANCE X302-7 EEC (24V), SCALANCE X302-7 EEC (24V, coated), SCALANCE X302-7 EEC (2x 230V), SCALANCE X302-7 EEC (2x 230V, coated), SCALANCE X302-7 EEC (2x 24V), SCALANCE X302-7 EEC (2x 24V, coated), SCALANCE X304-2FE, SCALANCE X306-1LD FE, SCALANCE X307-2 EEC (230V), SCALANCE X307-2 EEC (230V, coated), SCALANCE X307-2 EEC (24V), SCALANCE X307-2 EEC (24V, coated), SCALANCE X307-2 EEC (2x 230V), SCALANCE X307-2 EEC (2x 230V, coated), SCALANCE X307-2 EEC (2x 24V), SCALANCE X307-2 EEC (2x 24V, coated), SCALANCE X307-3, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M, SCALANCE X308-2M PoE, SCALANCE X308-2M PoE, SCALANCE X308-2M TS, SCALANCE X308-2M TS, SCALANCE X310, SCALANCE X310, SCALANCE X310FE, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, SCALANCE X408-2, SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on front), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (230V, ports on rear), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on front), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M (24V, ports on rear), SCALANCE XR324-12M TS (24V), SCALANCE XR324-12M TS (24V), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on front), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (24V, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on front), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 100-240VAC/60-250VDC, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on front), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M EEC (2x 24V, ports on rear), SCALANCE XR324-4M PoE (230V, ports on front), SCALANCE XR324-4M PoE (230V, ports on rear), SCALANCE XR324-4M PoE (24V, ports on front), SCALANCE XR324-4M PoE (24V, ports on rear), SCALANCE XR324-4M PoE TS (24V, ports on front), SIPLUS NET SCALANCE X308-2. The webserver of an affected device is missing specific security headers. This could allow an remote attacker to extract confidential session information under certain circumstances.

• Variants of SCALANCE X302-7 EEC, SCALANCE X304-2FE, and SCALANCE X306-1LD FE are affected in all versions < V4.1.4.
• Variants of SCALANCE X307-2 EEC, SCALANCE X307-3, SCALANCE X307-3LD, SCALANCE X308-2, SCALANCE X308-2LD, SCALANCE X308-2LH, SCALANCE X308-2LH+, SCALANCE X308-2M, SCALANCE X308-2M PoE, and SCALANCE X308-2M TS are affected in all versions < V4.1.4.
• SCALANCE X310, SCALANCE X310FE, SCALANCE X320-1 FE, SCALANCE X320-1-2LD FE, and SCALANCE X408-2 are affected in all versions < V4.1.4.
• Variants of SCALANCE XR324-12M, SCALANCE XR324-12M TS, SCALANCE XR324-4M EEC, SCALANCE XR324-4M PoE, and SCALANCE XR324-4M PoE TS, including the power and port-position options listed in the record, are affected in all versions < V4.1.4.
• SIPLUS NET SCALANCE X308-2 is affected in all versions < V4.1.4.
• Siemens' advisory directs customers to update affected products to V4.1.4 or later version. The status of parallel release branches is not described separately beyond that guidance.

The vulnerability is in the integrated webserver of Siemens SCALANCE X-300 devices and SIPLUS NET SCALANCE X308-2. The webserver is missing specific security headers, weakening protections for session information in HTTP responses. A remote attacker may target the webserver to extract confidential session information under certain circumstances. The record classifies the weakness as CWE-284: Improper Access Control, but does not identify the missing headers, a specific endpoint, request format, or extraction sequence. The normalized record describes network reachability without privileges or user interaction, while Siemens' advisory describes adjacent network access, high attack complexity, and user interaction. Because these exploitation conditions are not fully consistent, the exact preconditions should be assessed against the deployed environment.

• Reachability: The issue involves the device webserver and is described as potentially remotely exploitable. The normalized record describes network access, while the Siemens advisory limits the scenario to adjacent network access.
• Authentication: The supplied sources describe the issue as requiring no privileges or prior authentication.
• Interaction and complexity: The normalized record describes no user interaction and low complexity, but the Siemens advisory describes user interaction and high complexity. The precise conditions are unresolved in the available evidence.
• Exploitation status: The supplied evidence does not confirm active exploitation or a public exploit. This lack of confirmation is not evidence that exploitation has not occurred.
• No exploit steps, payloads, or specific indicators of compromise are provided in the reviewed evidence.

The vulnerability may expose confidential session information from the device webserver. The directly supported outcome is loss of confidentiality; there is no evidence that the issue directly changes data or disrupts service. If the exposed information is useful to a management session, the likely consequence could include weakened access control or increased risk of unauthorized access, but the evidence does not confirm session takeover or configuration changes. The practical impact depends on webserver reachability, the type of session information returned, and how the device is segmented within the industrial network.

• Confidentiality: Confidential session information may be exposed from the device webserver under certain conditions.
• Access risk: Disclosure of session information could weaken management-session confidentiality and may increase the risk of unauthorized access, but the available evidence does not establish that this issue alone enables session takeover.
• Operational scope: Siemens describes SCALANCE X switches as products used to connect industrial components such as PLCs and HMIs, so disclosure of management information could affect the administrative boundary of an industrial control network.
• Impact limit: The evidence supports a direct confidentiality impact. It does not support a direct integrity or availability impact.

1. Update the firmware: Update each affected device to V4.1.4 or later version according to Siemens' guidance. Confirm the exact model and hardware variant before scheduling maintenance.
2. Reduce network exposure: Restrict access to affected systems, especially 22/tcp, 161/udp, and 443/tcp, to trusted IP addresses only.
3. Disable unnecessary services: Disable SNMP where possible and operationally appropriate.
4. Disable the webserver when unnecessary: Deactivate the webserver if the product supports this and the interface is not needed for operations.
5. After updating or applying mitigations, verify the firmware, webserver state, and management-interface access scope. Mitigations do not replace firmware updates where the update can be deployed.

1. Inventory devices in the SCALANCE X302-7 EEC, X304-2FE, X306-1LD FE, X307, X308, X310, X320, X408, XR324, and SIPLUS NET SCALANCE X308-2 families.
2. Check each device's firmware and compare it with the affected boundary of all versions < V4.1.4. Record the exact model, power variant, coating, PoE, TS, and port-position variant.
3. Determine whether the management webserver is enabled and whether it is reachable from untrusted network zones.
4. Inspect HTTP responses from the device webserver for the required security headers according to Siemens' expected configuration or patched behavior. The advisory does not name the missing headers, so checking one individual header is not sufficient.
5. Review management-interface access logs and traffic for unusual session-related activity. This is precautionary monitoring, not a vendor-confirmed indicator of compromise.
6. No specific log event, IOC, or traffic signature is provided that can establish the device is safe.