Resource exhaustion in Siemens products - CVE-2023-44321

Vulnerability identifier: #VU83420

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-44321

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote administrator can trigger resource exhaustion and perform a denial of service (DoS) attack.

SCALANCE XP208PoE EEC
SCALANCE XC216EEC
SCALANCE XC224
SCALANCE XC224-4C G
SCALANCE XC224-4C G EEC
SCALANCE XF204
SCALANCE XF204 DNA
SCALANCE XF204-2BA
SCALANCE XF204-2BA DNA
SCALANCE XP208
SCALANCE XP208EEC
SCALANCE XC216-4C G EEC
SCALANCE XP216
SCALANCE XP216EEC
SCALANCE XP216POE EEC
SCALANCE XR324WG
SCALANCE XR326-2C PoE WG
SCALANCE XR328-4C WG
SIPLUS NET SCALANCE XC206-2
SIPLUS NET SCALANCE XC206-2SFP
SIPLUS NET SCALANCE XC208
SIPLUS NET SCALANCE XC216-4C
SCALANCE XC206-2SFP G
SCALANCE XB205-3LD
SCALANCE XB208
SCALANCE XB213-3
SCALANCE XB213-3LD
SCALANCE XB216
SCALANCE XC206-2
SCALANCE XC206-2G PoE
SCALANCE XC206-2G PoE EEC
SCALANCE XC206-2SFP
SCALANCE XC206-2SFP EEC
SCALANCE XB205-3
SCALANCE XC206-2SFP G EEC
SCALANCE XC208
SCALANCE XC208EEC
SCALANCE XC208G
SCALANCE XC208G EEC
SCALANCE XC208G PoE
SCALANCE XC216
SCALANCE XC216-3G PoE
SCALANCE XC216-4C
SCALANCE XC216-4C G
SCALANCE XC224-4C G (EIP Def.)
SCALANCE XP208 (Ethernet/IP)
SCALANCE XC216-4C G (EIP Def.)
SCALANCE XC216-3G PoE (54 V DC)
SCALANCE XC208G PoE (54 V DC)
SCALANCE XC208G (EIP def.)
SCALANCE XP216 (Ethernet/IP)
SCALANCE M876-3 (ROK)
PN)
SCALANCE XB205-3 (SC
SCALANCE S615 EEC
SCALANCE MUM856-1 (RoW)
SCALANCE MUM856-1 (EU)
SCALANCE MUM853-1 (EU)
SCALANCE M876-4 (NAM)
SCALANCE M876-4 (EU)
SCALANCE M876-4
SCALANCE XB205-3 (ST
SCALANCE M876-3 (EVDO)
SCALANCE M874-3
SCALANCE M874-2
SCALANCE M826-2 SHDSL-Router
SCALANCE M816-1 ADSL-Router (Annex B)
SCALANCE M816-1 ADSL-Router (Annex A)
SCALANCE M812-1 ADSL-Router (Annex B)
SCALANCE M812-1 ADSL-Router (Annex A)
SCALANCE M804PB
RUGGEDCOM RM1224 LTE(4G) NAM
SCALANCE XC206-2 (ST/BFOC)
SCALANCE XC206-2SFP G (EIP DEF.)
SCALANCE XC206-2G PoE EEC (54 V DC)
RUGGEDCOM RM1224 LTE(4G) EU
SCALANCE XC206-2 (SC)
SCALANCE XB216 (PN)
SCALANCE XB216 (E/IP)
SCALANCE XB213-3LD (SC
SCALANCE XB213-3 (ST
SCALANCE XB213-3 (SC
SCALANCE XB208 (PN)
SCALANCE XB208 (E/IP)
SCALANCE XB205-3LD (SC
E/IP)
SCALANCE XR326-2C PoE WG (without UL)
SCALANCE XR328-4C WG (28xGE
DC24V)
24V)
AC230V)
4xGE
SCALANCE XR328-4C WG (24xFE
DC 24V)
AC 230V)
SCALANCE XR324WG (24 x FE
SCALANCE S615
SCALANCE XC206-2G PoE (54 V DC)

Install updates from vendor's website.

SCALANCE XP208PoE EEC - update to 4.5
SCALANCE XC216EEC - update to 4.5
SCALANCE XC224 - update to 4.5
SCALANCE XC224-4C G - update to 4.5
SCALANCE XC224-4C G EEC - update to 4.5
SCALANCE XF204 - update to 4.5
SCALANCE XF204 DNA - update to 4.5
SCALANCE XF204-2BA - update to 4.5
SCALANCE XF204-2BA DNA - update to 4.5
SCALANCE XP208 - update to 4.5
SCALANCE XP208EEC - update to 4.5
SCALANCE XC216-4C G EEC - update to 4.5
SCALANCE XP216 - update to 4.5
SCALANCE XP216EEC - update to 4.5
SCALANCE XP216POE EEC - update to 4.5
SCALANCE XR324WG - update to 4.5
SCALANCE XR326-2C PoE WG - update to 4.5
SCALANCE XR328-4C WG - update to 4.5
SIPLUS NET SCALANCE XC206-2 - update to 4.5
SIPLUS NET SCALANCE XC206-2SFP - update to 4.5
SIPLUS NET SCALANCE XC208 - update to 4.5
SIPLUS NET SCALANCE XC216-4C - update to 4.5
SCALANCE XC206-2SFP G - update to 4.5
SCALANCE XB205-3LD - update to 4.5
SCALANCE XB208 - update to 4.5
SCALANCE XB213-3 - update to 4.5
SCALANCE XB213-3LD - update to 4.5
SCALANCE XB216 - update to 4.5
SCALANCE XC206-2 - update to 4.5
SCALANCE XC206-2G PoE - update to 4.5
SCALANCE XC206-2G PoE EEC - update to 4.5
SCALANCE XC206-2SFP - update to 4.5
SCALANCE XC206-2SFP EEC - update to 4.5
SCALANCE XB205-3 - update to 4.5
SCALANCE XC206-2SFP G EEC - update to 4.5
SCALANCE XC208 - update to 4.5
SCALANCE XC208EEC - update to 4.5
SCALANCE XC208G - update to 4.5
SCALANCE XC208G EEC - update to 4.5
SCALANCE XC208G PoE - update to 4.5
SCALANCE XC216 - update to 4.5
SCALANCE XC216-3G PoE - update to 4.5
SCALANCE XC216-4C - update to 4.5
SCALANCE XC216-4C G - update to 4.5

• https://cert-portal.siemens.com/productcert/txt/ssa-699386.txt

• Multiple vulnerabilities in Siemens SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family
• Multiple vulnerabilities in Siemens SCALANCE M-800/S615 Family
• Multiple vulnerabilities in Siemens SCALANCE XB-200 / XC-200 / XP-200 / XF-200BA / XR-300WG Family