Denial of service in Siemens SCALANCE and RUGGEDCOM Products

1) Input validation error

EUVDB-ID: #VU68287

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2022-31766

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when TCP Event service is enabled. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

SCALANCE WAM763-1: - - 1.1.0

SCALANCE WAM766-1: - - 1.1.0

SCALANCE WAM766-1 6GHz: - - 1.1.0

SCALANCE WAM766-1 EEC: - - 1.1.0

SCALANCE WAM766-1 EEC 6GHz: - - 1.1.0

SCALANCE WUM763-1: - - 1.1.0

SCALANCE WUM766-1: - - 1.1.0

SCALANCE WUM766-1 6GHz: - - 1.1.0

RUGGEDCOM RM1224 LTE: before 7.1.2

SCALANCE M804PB: before 7.1.2

SCALANCE M812-1 ADSL-Router (Annex A): before 7.1.2

SCALANCE M812-1 ADSL-Router (Annex B): before 7.1.2

SCALANCE M816-1 ADSL-Router (Annex A): before 7.1.2

SCALANCE M816-1 ADSL-Router (Annex B): before 7.1.2

SCALANCE M826-2 SHDSL-Router: before 7.1.2

SCALANCE M874-2: before 7.1.2

SCALANCE M874-3: before 7.1.2

SCALANCE M876-3: before 7.1.2

SCALANCE M876-4: before 7.1.2

SCALANCE MUM853-1: before 7.1.2

SCALANCE MUM856-1: before 7.1.2

SCALANCE S615: before 7.1.2

CPE2.3

• cpe:2.3:h:siemens:scalance_wam763-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam763-1:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1_6ghz:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1_6ghz:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1_eec:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1_eec:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1_eec_6ghz:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wam766-1_eec_6ghz:1.1.0:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wum763-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wum766-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_wum766-1_6ghz:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:ruggedcom_rm1224_lte:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m804pb:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m812-1_adsl-router_annex_a:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m812-1_adsl-router_annex_b:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m816-1_adsl-router_annex_a:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m816-1_adsl-router_annex_b:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m826-2_shdsl-router:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m874-2:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m874-3:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m876-3:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_m876-4:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_mum853-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_mum856-1:*:*:*:*:*:*:*:*
• cpe:2.3:h:siemens:scalance_s615:*:*:*:*:*:*:*:*

External links

https://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.