Use of a broken or risky cryptographic algorithm in Siemens SCALANCE Products

1) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU70422

Risk: Medium

CVSSv3.1: 6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2022-46140

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected device uses a weak encryption scheme to encrypt the debug zip file. A remote user can decrypt the contents of the file and retrieve debug information about the system.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RUGGEDCOM RM1224 LTE(4G) EU: All versions

RUGGEDCOM RM1224 LTE(4G) NAM: All versions

SCALANCE M804PB: All versions

SCALANCE M812-1 ADSL-Router (Annex A): All versions

SCALANCE M812-1 ADSL-Router (Annex B): All versions

SCALANCE M816-1 ADSL-Router (Annex A): All versions

SCALANCE M816-1 ADSL-Router (Annex B): All versions

SCALANCE M826-2 SHDSL-Router: All versions

SCALANCE M874-2: All versions

SCALANCE M874-3: All versions

SCALANCE M876-3: All versions

SCALANCE M876-3 (ROK): All versions

SCALANCE M876-4: All versions

SCALANCE M876-4 (EU): All versions

SCALANCE M876-4 (NAM): All versions

SCALANCE MUM853-1 (EU): All versions

SCALANCE MUM856-1 (EU): All versions

SCALANCE MUM856-1 (RoW): All versions

SCALANCE S615: All versions

SCALANCE S615 EEC: All versions

SCALANCE W721-1 RJ45: All versions

SCALANCE W722-1 RJ45: All versions

SCALANCE W734-1 RJ45: All versions

SCALANCE W734-1 RJ45 (USA): All versions

SCALANCE W738-1 M12: All versions

SCALANCE W748-1 M12: All versions

SCALANCE W748-1 RJ45: All versions

SCALANCE W761-1 RJ45: All versions

SCALANCE W774-1 M12 EEC: All versions

SCALANCE W774-1 RJ45: All versions

SCALANCE W774-1 RJ45 (USA): All versions

SCALANCE W778-1 M12: All versions

SCALANCE W778-1 M12 EEC: All versions

SCALANCE W778-1 M12 EEC (USA): All versions

SCALANCE W786-1 RJ45: All versions

SCALANCE W786-2 RJ45: All versions

SCALANCE W786-2 SFP: All versions

SCALANCE W786-2IA RJ45: All versions

SCALANCE W788-1 M12: All versions

SCALANCE W788-1 RJ45: All versions

SCALANCE W788-2 M12: All versions

SCALANCE W788-2 M12 EEC: All versions

SCALANCE W788-2 RJ45: All versions

SCALANCE W788-2 RJ45): All versions

SCALANCE W1748-1 M12: All versions

SCALANCE W1788-1 M12: All versions

SCALANCE W1788-2 EEC M12: All versions

SCALANCE W1788-2 M12: All versions

SCALANCE W1788-2IA M12: All versions

SCALANCE WAM763-1: All versions

SCALANCE WAM766-1: All versions

SCALANCE WAM766-1 6GHz: All versions

SCALANCE WAM766-1 EEC: All versions

SCALANCE WAM766-1 EEC 6GHz: All versions

SCALANCE WUM763-1: All versions

SCALANCE WUM766-1: All versions

SCALANCE WUM766-1 6GHz: All versions

SCALANCE XB205-3 (SC: All versions

PN): All versions

SCALANCE XB205-3 (ST: All versions

E/IP): All versions

SCALANCE XB205-3LD (SC: All versions

SCALANCE XB208 (E/IP): All versions

SCALANCE XB208 (PN): All versions

SCALANCE XB213-3 (SC: All versions

SCALANCE XB213-3 (ST: All versions

SCALANCE XB213-3LD (SC: All versions

SCALANCE XB216 (E/IP): All versions

SCALANCE XB216 (PN): All versions

SCALANCE XC206-2 (SC): All versions

SCALANCE XC206-2 (ST/BFOC): All versions

SCALANCE XC206-2G PoE: All versions

SCALANCE XC206-2G PoE EEC (54 V DC): All versions

SCALANCE XC206-2SFP: All versions

SCALANCE XC206-2SFP EEC: All versions

SCALANCE XC206-2SFP G: All versions

SCALANCE XC206-2SFP G (EIP DEF.): All versions

SCALANCE XC206-2SFP G EEC: All versions

SCALANCE XC208: All versions

SCALANCE XC208EEC: All versions

SCALANCE XC208G: All versions

SCALANCE XC208G (EIP def.): All versions

SCALANCE XC208G EEC: All versions

SCALANCE XC208G PoE: All versions

SCALANCE XC208G PoE (54 V DC): All versions

SCALANCE XC21: All versions

SCALANCE XC216-3G PoE: All versions

SCALANCE XC216-3G PoE (54 V DC): All versions

SCALANCE XC216-4C: All versions

SCALANCE XC216-4C G: All versions

SCALANCE XC216-4C G (EIP Def.): All versions

SCALANCE XC216-4C G EEC: All versions

SCALANCE XC216EEC: All versions

SCALANCE XC224: All versions

SCALANCE XC224-4C G: All versions

SCALANCE XC224-4C G (EIP Def.): All versions

SCALANCE XC224-4C G EEC: All versions

SCALANCE XF204: All versions

SCALANCE XF204 DNA: All versions

SCALANCE XF204-2BA: All versions

SCALANCE XF204-2BA DNA: All versions

SCALANCE XM408-4C: All versions

SCALANCE XM408-4C (L3 int.): All versions

SCALANCE XM408-8C: All versions

SCALANCE XM408-8C (L3 int.): All versions

SCALANCE XM416-4C: All versions

SCALANCE XM416-4C (L3 int.): All versions

SCALANCE XP208: All versions

SCALANCE XP208 (Ethernet/IP): All versions

SCALANCE XP208EEC: All versions

SCALANCE XP208PoE EEC: All versions

SCALANCE XP216: All versions

SCALANCE XP216 (Ethernet/IP): All versions

SCALANCE XP216EEC: All versions

SCALANCE XP216POE EEC: All versions

SCALANCE XR324WG: All versions

SCALANCE XR326-2C PoE WG: All versions

SCALANCE XR328-4C WG: All versions

SCALANCE XR524-8C 1x230V: All versions

SCALANCE XR524-8C 1x230V (L3 int.): All versions

SCALANCE XR524-8C 2x230V: All versions

SCALANCE XR524-8C 2x230V (L3 int.): All versions

SCALANCE XR524-8C 24V: All versions

SCALANCE XR524-8C 24V (L3 int.): All versions

SCALANCE XR526-8C 1x230V: All versions

SCALANCE XR526-8C 1x230V (L3 int.): All versions

SCALANCE XR526-8C 2x230V: All versions

SCALANCE XR526-8C 2x230V (L3 int.): All versions

SCALANCE XR526-8C 24V: All versions

SCALANCE XR526-8C 24V (L3 int.): All versions

SCALANCE XR528-6M: All versions

SCALANCE XR528-6M (2HR2): All versions

SCALANCE XR528-6M (2HR2: All versions

L3 int.): All versions

SCALANCE XR528-6M (L3 int.): All versions

SCALANCE XR552-12M: All versions

SCALANCE XR552-12M (2HR2: All versions

SIPLUS NET SCALANCE XC206-2: All versions

SIPLUS NET SCALANCE XC206-2SFP: All versions

SIPLUS NET SCALANCE XC208: All versions

SIPLUS NET SCALANCE XC216-4C: All versions

External links

http://cert-portal.siemens.com/productcert/pdf/ssa-413565.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.