Critical SSA-710008 3 CVEs

SSA-710008: Multiple Web Vulnerabilities in SCALANCE Products

Published Aug 9, 2022 · Updated Apr 14, 2026 · Revision 6

Vendor: Siemens Product: RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) Product: RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) Product: SCALANCE M804PB (6GK5804-0AP00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) Product: SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) Product: SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) Product: SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) Product: SCALANCE M874-2 (6GK5874-2AA00-2AA2) Product: SCALANCE M874-3 (6GK5874-3AA00-2AA2) Product: SCALANCE M876-3 (6GK5876-3AA02-2BA2) Product: SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) Product: SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) Product: SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) Product: SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) Product: SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) Product: SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) Product: SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) Product: SCALANCE SC622-2C (6GK5622-2GS00-2AC2) Product: SCALANCE SC626-2C (6GK5626-2GS00-2AC2) Product: SCALANCE SC632-2C (6GK5632-2GS00-2AC2) Product: SCALANCE SC636-2C (6GK5636-2GS00-2AC2) Product: SCALANCE SC642-2C (6GK5642-2GS00-2AC2) Product: SCALANCE SC646-2C (6GK5646-2GS00-2AC2) Product: SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0) Product: SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0) Product: SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0) Product: SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0) Product: SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0) +121 more

Summary

SCALANCE devices contain multiple vulnerabilities in MSPS based product lines that could allow authenticated remote attackers to execute custom code or create a XSS situation, as well as unauthenticated remote attackers to create a denial of service condition.

Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

Vulnerabilities 3

Critical 9.1

CVE-2022-36323

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with admini…

Siemens SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router SCALANCE M826-2 SHDSL-Router ICS / OT

Aug 10, 2022
High 7.5

CVE-2022-36324

Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated re…

Siemens SCALANCE M874-3 SCALANCE M876-3 (ROK) SCALANCE M804PB ICS / OT

Aug 10, 2022
Medium 6.8

CVE-2022-36325

Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow…

Siemens SCALANCE M874-2 SCALANCE M876-4 (EU) SCALANCE S615 LAN-Router ICS / OT

Aug 10, 2022

Revision history

2026-04-14 #6
Added fix for SCALANCE W-700 IEEE 802.11n family
2023-10-10 #5
Added that SCALANCE SC-600 family was also affected by CVE-2022-36324
2023-04-11 #4
Added fix for SCALANCE XM-400/XR-500 family and for SCALANCE XB-200/XC-200/XP-200/XF-200BA/XR-300WG family
2023-01-10 #3
Added fix for SCALANCE W-700 IEEE 802.11ax product family
2022-09-13 #2
Added fix for SCALANCE M-800, SCALANCE MUM-800 and RUGGEDCOM RM1224 families, as well as for SCALANCE S615 families; All affected product families were expanded
2022-08-09 #1
Publication Date

References

SSA-710008: Multiple Web Vulnerabilities in SCALANCE Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-710008.html