Critical ICSA-23-320-08 13 CVEs

Siemens SCALANCE Family Products

Published Nov 14, 2023 · Updated Mar 12, 2024 · Revision 3

Vendor: Siemens Product: SCALANCE XB205-3 (SC, PN) (6GK5205-3BB00-2AB2) Product: SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BB00-2TB2) Product: SCALANCE XB205-3 (ST, E/IP) (6GK5205-3BD00-2TB2) Product: SCALANCE XB205-3 (ST, PN) (6GK5205-3BD00-2AB2) Product: SCALANCE XB205-3LD (SC, E/IP) (6GK5205-3BF00-2TB2) Product: SCALANCE XB205-3LD (SC, PN) (6GK5205-3BF00-2AB2) Product: SCALANCE XB208 (E/IP) (6GK5208-0BA00-2TB2) Product: SCALANCE XB208 (PN) (6GK5208-0BA00-2AB2) Product: SCALANCE XB213-3 (SC, E/IP) (6GK5213-3BD00-2TB2) Product: SCALANCE XB213-3 (SC, PN) (6GK5213-3BD00-2AB2) Product: SCALANCE XB213-3 (ST, E/IP) (6GK5213-3BB00-2TB2) Product: SCALANCE XB213-3 (ST, PN) (6GK5213-3BB00-2AB2) Product: SCALANCE XB213-3LD (SC, E/IP) (6GK5213-3BF00-2TB2) Product: SCALANCE XB213-3LD (SC, PN) (6GK5213-3BF00-2AB2) Product: SCALANCE XB216 (E/IP) (6GK5216-0BA00-2TB2) Product: SCALANCE XB216 (PN) (6GK5216-0BA00-2AB2) Product: SCALANCE XC206-2 (SC) (6GK5206-2BD00-2AC2) Product: SCALANCE XC206-2 (ST/BFOC) (6GK5206-2BB00-2AC2) Product: SCALANCE XC206-2G PoE (54 V DC) (6GK5206-2RS00-5AC2) Product: SCALANCE XC206-2G PoE (6GK5206-2RS00-2AC2) Product: SCALANCE XC206-2G PoE EEC (54 V DC) (6GK5206-2RS00-5FC2) Product: SCALANCE XC206-2SFP (6GK5206-2BS00-2AC2) Product: SCALANCE XC206-2SFP EEC (6GK5206-2BS00-2FC2) Product: SCALANCE XC206-2SFP G (6GK5206-2GS00-2AC2) Product: SCALANCE XC206-2SFP G (EIP DEF.) (6GK5206-2GS00-2TC2) Product: SCALANCE XC206-2SFP G EEC (6GK5206-2GS00-2FC2) Product: SCALANCE XC208 (6GK5208-0BA00-2AC2) Product: SCALANCE XC208EEC (6GK5208-0BA00-2FC2) Product: SCALANCE XC208G (6GK5208-0GA00-2AC2) +42 more

Summary

SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG Family before V4.5 is affected by multiple vulnerabilities.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 13

Critical 9.1

CVE-2023-44373

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…

Siemens SCALANCE M876-3 (ROK) SCALANCE M804PB SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
High 7.5

CVE-2022-4450 EPSS 29%

Double free after calling PEM_read_bio_ex

The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Feb 8, 2023
High 7.5

CVE-2023-0216

Invalid pointer dereference in d2i_PKCS7 functions

An invalid pointer dereference on read can be triggered when an application tries to load malformed PKCS7 data with the d2i_PKCS7(), d2i_PKCS7_bio() or d2i_PKCS7_fp() functions. The result of the dereference is an application crash which could lead to a denia…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io

Feb 8, 2023
High 7.5

CVE-2023-0217

NULL dereference validating DSA public key

An invalid pointer dereference on read can be triggered when an application tries to check a malformed DSA public key by the EVP_PKEY_public_check() function. This will most likely lead to an application crash. This function can be called on public keys suppl…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io

Feb 8, 2023
High 7.5

CVE-2023-0401

NULL dereference during PKCS7 data verification

A NULL pointer can be dereferenced when signatures are being verified on PKCS7 signed or signedAndEnveloped data. In case the hash algorithm used for the signature is known to the OpenSSL library but the implementation of the hash algorithm is not available t…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Alpine Wolfi crates.io

Feb 8, 2023
High 7.2

CVE-2023-44317

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGED…

Siemens SCALANCE M874-3 SCALANCE M876-3 (ROK) SCALANCE M804PB ICS / OT

Nov 14, 2023
Medium 6.5

CVE-2023-2650 EPSS 75%

Possible DoS translating ASN.1 object identifiers

Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi

May 30, 2023
Medium 6.5

CVE-2023-44374

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M874-2 SCALANCE M876-3 (ROK) SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
Medium 5.9

CVE-2022-4304 Public exploit EPSS 24%

Timing Oracle in RSA Decryption

A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi crates.io

Feb 8, 2023
Medium 4.9

CVE-2022-4203

X.509 Name Constraints Read Buffer Overflow

A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for t…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine Wolfi crates.io

Feb 24, 2023
Medium 4.9

CVE-2023-44319

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M804PB SCALANCE M876-4 (NAM) SCALANCE M874-2 ICS / OT

Nov 14, 2023
Medium 4.3

CVE-2023-44320

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGED…

Siemens SCALANCE M876-3 (ROK) SCALANCE M804PB SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
Low 3.7

CVE-2023-44322

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M826-2 SHDSL-Router SCALANCE M874-3 SCALANCE M876-3 (ROK) ICS / OT

Nov 14, 2023

Revision history

2024-03-12 #3
Move CVE-2023-44318 and CVE-2023-44321 to SSA-353002 as it currently is still unfixed.
2023-12-12 #2
Clarify: Remove product description for SCALANCE M-800/S615
2023-11-14 #1
Publication Date

References

SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-699386.html
SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
SSA-699386: Multiple Vulnerabilities in SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family before V4.5 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-699386.txt
ICS Advisory ICSA-23-320-08 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-320-08
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B