Multiple vulnerabilities in Siemens SCALANCE W700 802.11 AX Family
| Risk | Medium |
| Patch available | NO |
| Number of vulnerabilities | 8 |
| CVE-ID | CVE-2022-46144 CVE-2023-44317 CVE-2023-44318 CVE-2023-44319 CVE-2023-44373 CVE-2022-36323 CVE-2023-44374 CVE-2023-49691 |
| CWE-ID | CWE-664 CWE-349 CWE-321 CWE-328 CWE-74 CWE-284 CWE-78 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
SCALANCE WUM766-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WUM763-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM766-1 EEC Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM766-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM763-1 Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 8 vulnerabilities.
1) Improper control of a resource through its lifetime
EUVDB-ID: #VU70421
Risk: Medium
CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-46144
CWE-ID:
CWE-664 - Improper control of a resource through its lifetime
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to the affected device does not properly process CLI commands after a user forcefully quitted the SSH connection. A remote user can cause a denial of service condition on the target system.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Acceptance of Extraneous Untrusted Data With Trusted Data
EUVDB-ID: #VU83415
Risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-44317
CWE-ID:
CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to the affected products do not properly validate the content of uploaded X509 certificates. A remote administrator can execute arbitrary code on the target device.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Use of Hard-coded Cryptographic Key
EUVDB-ID: #VU83416
Risk: Low
CVSSv3.1: 4.5 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-44318
CWE-ID:
CWE-321 - Use of Hard-coded Cryptographic Key
Exploit availability: No
DescriptionThe vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to the usage a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. A remote administrator can obtain a configuration backup to extract configuration information from the exported file.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Reversible One-Way Hash
EUVDB-ID: #VU83417
Risk: Low
CVSSv3.1: 4.5 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-44319
CWE-ID:
CWE-328 - Use of Weak Hash
Exploit availability: No
DescriptionThe vulnerability allows a user attacker to compromise the target system.
The vulnerability exists due to use of a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. A remote administrator can upload a modified configuration file to change the configuration of an affected device.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Improper Neutralization of Special Elements in Output Used by a Downstream Component
EUVDB-ID: #VU83425
Risk: Low
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-44373
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote administrator can execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Improper Neutralization of Special Elements in Output Used by a Downstream Component
EUVDB-ID: #VU66368
Risk: Low
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2022-36323
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary code on the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote administrator can inject arbitrary code or spawn a system root shell.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Improper access control
EUVDB-ID: #VU83426
Risk: Medium
CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-44374
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to affected devices insufficiently check which password is to be changed. A remote user can change the password and gain elevtaed privileges.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) OS Command Injection
EUVDB-ID: #VU84423
Risk: Low
CVSSv3.1: 6.6 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]
CVE-ID: CVE-2023-49691
CWE-ID:
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Exploit availability: No
DescriptionThe vulnerability allows a remote user to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation in the handling of the DDNS configuration. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationCybersecurity Help is currently unaware of any official solution to address this vulnerability.
Vulnerable software versionsSCALANCE WUM766-1: All versions
SCALANCE WUM763-1: All versions
SCALANCE WAM766-1 EEC: All versions
SCALANCE WAM766-1: All versions
SCALANCE WAM763-1: All versions
External linkshttp://cert-portal.siemens.com/productcert/txt/ssa-690517.txt
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
