Use of Hard-coded Cryptographic Key in Siemens products - CVE-2023-44318

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU83416

Use of Hard-coded Cryptographic Key in Siemens products - CVE-2023-44318

Published: November 22, 2023


Vulnerability identifier: #VU83416
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-44318
CWE-ID: CWE-321
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to the usage a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. A remote administrator can obtain a configuration backup to extract configuration information from the exported file.


Affected software

SCALANCE XP208PoE EEC
SCALANCE XC216EEC
SCALANCE XC224
SCALANCE XC224-4C G
SCALANCE XC224-4C G EEC
SCALANCE XF204
SCALANCE XF204 DNA
SCALANCE XF204-2BA
SCALANCE XF204-2BA DNA
SCALANCE XP208
SCALANCE XP208EEC
SCALANCE XC216-4C G EEC
SCALANCE XP216
SCALANCE XP216EEC
SCALANCE XP216POE EEC
SCALANCE XR324WG
SCALANCE XR326-2C PoE WG
SCALANCE XR328-4C WG
SIPLUS NET SCALANCE XC206-2
SIPLUS NET SCALANCE XC206-2SFP
SIPLUS NET SCALANCE XC208
SIPLUS NET SCALANCE XC216-4C
SCALANCE XC206-2SFP G
SCALANCE XB205-3LD
SCALANCE XB208
SCALANCE XB213-3
SCALANCE XB213-3LD
SCALANCE XB216
SCALANCE XC206-2
SCALANCE XC206-2G PoE
SCALANCE XC206-2G PoE EEC
SCALANCE XC206-2SFP
SCALANCE XC206-2SFP EEC
SCALANCE XB205-3
SCALANCE XC206-2SFP G EEC
SCALANCE XC208
SCALANCE XC208EEC
SCALANCE XC208G
SCALANCE XC208G EEC
SCALANCE XC208G PoE
SCALANCE XC216
SCALANCE XC216-3G PoE
SCALANCE XC216-4C
SCALANCE XC216-4C G
SCALANCE XP208 (Ethernet/IP)
SCALANCE XC224-4C G (EIP Def.)
SCALANCE XP216 (Ethernet/IP)
SCALANCE XC216-4C G (EIP Def.)
SCALANCE XC216-3G PoE (54 V DC)
SCALANCE XC208G PoE (54 V DC)
SCALANCE WUM766-1
SCALANCE WUM763-1
SCALANCE WAM766-1 EEC
SCALANCE WAM766-1
SCALANCE WAM763-1
SCALANCE M876-3 (ROK)
SCALANCE XB205-3 (ST
PN)
SCALANCE XB205-3 (SC
SCALANCE S615 EEC
SCALANCE MUM856-1 (RoW)
SCALANCE MUM856-1 (EU)
SCALANCE MUM853-1 (EU)
SCALANCE M876-4 (NAM)
SCALANCE M876-4 (EU)
SCALANCE M876-4
E/IP)
SCALANCE M876-3 (EVDO)
SCALANCE M874-3
SCALANCE M874-2
SCALANCE M826-2 SHDSL-Router
SCALANCE M816-1 ADSL-Router (Annex B)
SCALANCE M816-1 ADSL-Router (Annex A)
SCALANCE M812-1 ADSL-Router (Annex B)
SCALANCE M812-1 ADSL-Router (Annex A)
SCALANCE M804PB
RUGGEDCOM RM1224 LTE(4G) NAM
SCALANCE XC208G (EIP def.)
SCALANCE XC206-2SFP G (EIP DEF.)
SCALANCE XC206-2G PoE EEC (54 V DC)
RUGGEDCOM RM1224 LTE(4G) EU
SCALANCE XC206-2 (ST/BFOC)
SCALANCE XC206-2 (SC)
SCALANCE XB216 (PN)
SCALANCE XB216 (E/IP)
SCALANCE XB213-3LD (SC
SCALANCE XB213-3 (ST
SCALANCE XB213-3 (SC
SCALANCE XB208 (PN)
SCALANCE XB208 (E/IP)
SCALANCE XB205-3LD (SC
24V)
SCALANCE XR328-4C WG (28xGE
DC24V)
AC230V)
4xGE
SCALANCE XR328-4C WG (24xFE
SCALANCE XR326-2C PoE WG (without UL)
DC 24V)
AC 230V)
SCALANCE XR324WG (24 x FE
SCALANCE S615
SCALANCE XC206-2G PoE (54 V DC)

How to mitigate CVE-2023-44318

Install updates from vendor's website.

SCALANCE XP208PoE EEC - update to 4.5
SCALANCE XC216EEC - update to 4.5
SCALANCE XC224 - update to 4.5
SCALANCE XC224-4C G - update to 4.5
SCALANCE XC224-4C G EEC - update to 4.5
SCALANCE XF204 - update to 4.5
SCALANCE XF204 DNA - update to 4.5
SCALANCE XF204-2BA - update to 4.5
SCALANCE XF204-2BA DNA - update to 4.5
SCALANCE XP208 - update to 4.5
SCALANCE XP208EEC - update to 4.5
SCALANCE XC216-4C G EEC - update to 4.5
SCALANCE XP216 - update to 4.5
SCALANCE XP216EEC - update to 4.5
SCALANCE XP216POE EEC - update to 4.5
SCALANCE XR324WG - update to 4.5
SCALANCE XR326-2C PoE WG - update to 4.5
SCALANCE XR328-4C WG - update to 4.5
SIPLUS NET SCALANCE XC206-2 - update to 4.5
SIPLUS NET SCALANCE XC206-2SFP - update to 4.5
SIPLUS NET SCALANCE XC208 - update to 4.5
SIPLUS NET SCALANCE XC216-4C - update to 4.5
SCALANCE XC206-2SFP G - update to 4.5
SCALANCE XB205-3LD - update to 4.5
SCALANCE XB208 - update to 4.5
SCALANCE XB213-3 - update to 4.5
SCALANCE XB213-3LD - update to 4.5
SCALANCE XB216 - update to 4.5
SCALANCE XC206-2 - update to 4.5
SCALANCE XC206-2G PoE - update to 4.5
SCALANCE XC206-2G PoE EEC - update to 4.5
SCALANCE XC206-2SFP - update to 4.5
SCALANCE XC206-2SFP EEC - update to 4.5
SCALANCE XB205-3 - update to 4.5
SCALANCE XC206-2SFP G EEC - update to 4.5
SCALANCE XC208 - update to 4.5
SCALANCE XC208EEC - update to 4.5
SCALANCE XC208G - update to 4.5
SCALANCE XC208G EEC - update to 4.5
SCALANCE XC208G PoE - update to 4.5
SCALANCE XC216 - update to 4.5
SCALANCE XC216-3G PoE - update to 4.5
SCALANCE XC216-4C - update to 4.5
SCALANCE XC216-4C G - update to 4.5

External References

Related Security Bulletins