Critical ICSA-23-348-14 7 CVEs

Siemens RUGGEDCOM and SCALANCE M-800/S615 Family

Published Dec 12, 2023 · Updated Aug 13, 2024 · Revision 2

Vendor: Siemens Product: RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Product: RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M876-3 (6GK5876-3AA02-2BA2) Product: SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) Product: SCALANCE M876-4 (6GK5876-4AA10-2BA2) Product: SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) Product: SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) Product: SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) Product: SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) Product: SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) Product: SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) Product: SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)

Summary

SCALANCE M-800 family before V8.0 is affected by multiple vulnerabilities.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 7

Critical 9.1

CVE-2023-44373

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…

Siemens SCALANCE M874-2 SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router ICS / OT

Nov 14, 2023
High 7.2

CVE-2023-49691

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router SCALANCE M826-2 SHDSL-Router ICS / OT

Dec 12, 2023
Medium 6.5

CVE-2023-44374

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M876-4 (NAM) SCALANCE M826-2 SHDSL-Router SCALANCE M874-3 ICS / OT

Nov 14, 2023
Medium 4.9

CVE-2023-44318

Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the de…

Siemens SCALANCE M874-2 SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router ICS / OT

Nov 14, 2023
Medium 4.9

CVE-2023-44319

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M874-2 SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router ICS / OT

Nov 14, 2023
Low 3.7

CVE-2023-44322

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M876-3 (ROK) SCALANCE M804PB SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
Low 2.7

CVE-2022-46143

Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an …

Siemens SCALANCE M874-3 SCALANCE M876-3 (ROK) SCALANCE M804PB ICS / OT

Dec 13, 2022

Revision history

2024-08-13 #2
Moved CVE-2023-44321 to SSA-087301 as fixed in V8.1, moved CVE-2023-44320 to SSA-068047 as fixed in V7.2.2
2023-12-12 #1
Publication Date

References

SSA-180704: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.0 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-180704.html
ICS Advisory ICSA-23-348-14 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-14
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B