High ICSA-24-165-12 4 CVEs

Siemens SCALANCE W700

Published Jun 11, 2024 · Updated Jan 14, 2025 · Revision 3

Vendor: Siemens Product: SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) Product: SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) Product: SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) Product: SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) Product: SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) Product: SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) Product: SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) Product: SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) Product: SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) Product: SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) Product: SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) Product: SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) Product: SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) Product: SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) Product: SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) Product: SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) Product: SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) Product: SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) Product: SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)

Summary

SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities.

Siemens has released a new version for SCALANCE W-700 IEEE 802.11ax family and recommends to update to the latest version. Siemens recommends countermeasures for vulnerabilities where fixes are not, or not yet available.

Vulnerabilities 4

High 7.2

CVE-2023-44317

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGED…

Siemens SCALANCE M874-3 SCALANCE M876-3 (ROK) SCALANCE M804PB ICS / OT

Nov 14, 2023
Medium 6.5

CVE-2023-44374

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M874-2 SCALANCE M876-3 (ROK) SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
Medium 4.9

CVE-2023-44318

Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the de…

Siemens SCALANCE M876-3 (ROK) SCALANCE M804PB SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
Medium 4.9

CVE-2023-44319

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCO…

Siemens SCALANCE M876-3 (ROK) SCALANCE M804PB SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023

Revision history

2025-01-14 #3
Added fix for CVE-2023-44317, CVE-2023-44319, CVE-2024-44374; added CVSSv4 vectors for all CVE IDs; removed CVE-2022-46144 as this is addressed in SSA-413565 and was fixed in V2.0.0
2024-09-10 #2
Move CVE-2023-44373 to SSA-721642 as fixed in V2.4 and remove CVE-2023-49691 as products are not affected
2024-06-11 #1
Publication Date

References

SSA-690517: Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-690517.html
ICS Advisory ICSA-24-165-12 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-12
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B