Critical SSA-019200 15 CVEs

SSA-019200: Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11n Devices Before V6.6.0

Published Apr 14, 2026 · Updated Apr 14, 2026

Vendor: Siemens Product: SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) Product: SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) Product: SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0) Product: SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0) Product: SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0) Product: SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0) Product: SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6) Product: SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0) Product: SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6) Product: SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0) Product: SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0) Product: SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0) Product: SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0) Product: SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0) Product: SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0) Product: SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0) Product: SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0) Product: SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0) Product: SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0) Product: SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0) Product: SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6) Product: SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0) Product: SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0) Product: SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6) Product: SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0) Product: SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0) Product: SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0) Product: SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0) Product: SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0) +20 more

Summary

SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities.

Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version.

Vulnerabilities 15

Critical 9.1

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…

Siemens SCALANCE M874-2 SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router ICS / OT

Aug 10, 2022
Critical 9.1

CVE-2023-44373

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…

Siemens SCALANCE M876-3 (ROK) SCALANCE M804PB SCALANCE M876-4 (NAM) ICS / OT

Nov 14, 2023
High 8.8

CVE-2022-31765

Affected devices do not properly authorize the change password function of the web interface. This could allow low priv…

Siemens SCALANCE M874-3 SCALANCE M876-3 (ROK) SCALANCE M804PB ICS / OT

Oct 11, 2022
High 7.5

CVE-2022-0778 Public exploit EPSS 73%

Infinite loop in BN_mod_sqrt() reachable when parsing certificates

The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…

OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io

Mar 15, 2022
High 7.5

CVE-2022-36324

Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated re…

Siemens SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router SCALANCE M826-2 SHDSL-Router ICS / OT

Aug 10, 2022
High 7.4

CVE-2021-3712 Public exploit EPSS 48%

Read buffer overruns processing ASN.1 strings

ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the string data and a field holding the buffer length. This contrasts with normal C strings which are repesented as a buffer for the string dat…

OpenSSL OpenSSL openssl openssl Debian Ubuntu Azure Linux Alpine crates.io

Aug 24, 2021
Medium 6.8

CVE-2022-36325

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow…

Siemens SCALANCE M804PB SCALANCE M876-4 (NAM) SCALANCE M874-2 ICS / OT

Aug 10, 2022
Medium 5.3

CVE-2020-26146

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WPA, WPA2, and WPA3 implementations reassemble fr…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

May 11, 2021
Unscored —

CVE-2020-24588

The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) does…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 11, 2021
Unscored —

CVE-2020-26139

An issue was discovered in the kernel in NetBSD 7.1. An Access Point (AP) forwards EAPOL frames to other clients even t…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 11, 2021
Unscored —

CVE-2020-26140

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementa…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

May 11, 2021
Unscored —

CVE-2020-26141

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The Wi-Fi implementation does not verif…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 11, 2021
Unscored —

CVE-2020-26143

An issue was discovered in the ALFA Windows 10 driver 1030.36.604 for AWUS036ACH. The WEP, WPA, WPA2, and WPA3 implemen…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

May 11, 2021
Unscored —

CVE-2020-26144

An issue was discovered on Samsung Galaxy S3 i9305 4.4.4 devices. The WEP, WPA, WPA2, and WPA3 implementations accept p…

linux-raspi2 linux-hwe linux-azure linux-riscv Ubuntu

May 11, 2021
Unscored —

CVE-2020-26147

An issue was discovered in the Linux kernel 5.8.9. The WEP, WPA, WPA2, and WPA3 implementations reassemble fragments ev…

linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu

May 11, 2021

Revision history

2026-04-14 #1
Publication Date

References

SSA-019200: Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11n Devices Before V6.6.0 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-019200.html