Multiple vulnerabilities in Siemens SCALANCE M-800/S615 Family

Published: 2023-12-14

Risk	Medium
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2022-46143 CVE-2023-44319 CVE-2023-44322 CVE-2023-44373 CVE-2023-44374 CVE-2022-36323 CVE-2023-49691
CWE-ID	CWE-20 CWE-328 CWE-252 CWE-74 CWE-284 CWE-78
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SCALANCE S615 EEC Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M812-1 ADSL-Router (Annex A) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE MUM856-1 (RoW) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE MUM856-1 (EU) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE MUM853-1 (EU) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-4 (NAM) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-4 (EU) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-4 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-3 (ROK) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-3 (EVDO) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M874-3 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M874-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M826-2 SHDSL-Router Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M816-1 ADSL-Router (Annex B) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M816-1 ADSL-Router (Annex A) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M812-1 ADSL-Router (Annex B) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M804PB Hardware solutions / Routers & switches, VoIP, GSM, etc RUGGEDCOM RM1224 LTE(4G) NAM Hardware solutions / Routers & switches, VoIP, GSM, etc RUGGEDCOM RM1224 LTE(4G) EU Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE S615 Hardware solutions / Firmware
Vendor	Siemens

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Input validation error

EUVDB-ID: #VU70424

Risk: Low

CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-46143

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information on the system.

The vulnerability exists due to the affected device does not check the TFTP blocksize correctly. A remote administrator can read from an uninitialized buffer that potentially contains previously allocated data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Reversible One-Way Hash

EUVDB-ID: #VU83417

Risk: Low

CVSSv3.1: 4.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-44319

CWE-ID: CWE-328 - Use of Weak Hash

Exploit availability: No

Description

The vulnerability allows a user attacker to compromise the target system.

The vulnerability exists due to use of a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. A remote administrator can upload a modified configuration file to change the configuration of an affected device.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Unchecked Return Value

EUVDB-ID: #VU83424

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-44322

CWE-ID: CWE-252 - Unchecked Return Value

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected devices can be configured to send emails when certain events occur on the device. A remote attacker can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU83425

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-44373

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote administrator can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper access control

EUVDB-ID: #VU83426

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-44374

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to affected devices insufficiently check which password is to be changed. A remote user can change the password and gain elevtaed privileges.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper Neutralization of Special Elements in Output Used by a Downstream Component

EUVDB-ID: #VU66368

Risk: Low

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-36323

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote administrator can inject arbitrary code or spawn a system root shell.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) OS Command Injection

EUVDB-ID: #VU84423

Risk: Low

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-49691

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote user to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation in the handling of the DDNS configuration. A remote administrator can pass specially crafted data to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SCALANCE S615 EEC: before 8.0

SCALANCE M812-1 ADSL-Router (Annex A): before 8.0

SCALANCE S615: before 8.0

SCALANCE MUM856-1 (RoW): before 8.0

SCALANCE MUM856-1 (EU): before 8.0

SCALANCE MUM853-1 (EU): before 8.0

SCALANCE M876-4 (NAM): before 8.0

SCALANCE M876-4 (EU): before 8.0

SCALANCE M876-4: before 8.0

SCALANCE M876-3 (ROK): before 8.0

SCALANCE M876-3 (EVDO): before 8.0

SCALANCE M874-3: before 8.0

SCALANCE M874-2: before 8.0

SCALANCE M826-2 SHDSL-Router: before 8.0

SCALANCE M816-1 ADSL-Router (Annex B): before 8.0

SCALANCE M816-1 ADSL-Router (Annex A): before 8.0

SCALANCE M812-1 ADSL-Router (Annex B): before 8.0

SCALANCE M804PB: before 8.0

RUGGEDCOM RM1224 LTE(4G) NAM: before 8.0

RUGGEDCOM RM1224 LTE(4G) EU: before 8.0

External links

http://cert-portal.siemens.com/productcert/txt/ssa-180704.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.