SSA-690517

Siemens Security Advisory by Siemens ProductCERT

SSA-690517: Multiple Vulnerabilities in SCALANCE W-700 IEEE 802.11ax Family

Publication Date:	2024-06-11
Last Update:	2025-01-14
Current Version:	V1.2
CVSS v3.1 Base Score:	7.2
CVSS v4.0 Base Score:	8.6

SUMMARY

SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities.

Siemens has released a new version for SCALANCE W-700 IEEE 802.11ax family and recommends to update to the latest version. Siemens recommends countermeasures for vulnerabilities where fixes are not, or not yet available.

AFFECTED PRODUCTS AND SOLUTION

Un-/Collapse All

Affected Product and Versions	Remediation
SCALANCE W-700 IEEE 802.11ax family	Open for details
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)	Open for details
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM763-1 (6GK5763-1AL00-7DA0)	Open for details
SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0)	Open for details
SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0)	Open for details
SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM766-1 (6GK5766-1GE00-7DA0)	Open for details
SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0)	Open for details
SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0)	Open for details
SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0)	Open for details
SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0)	Open for details
SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0)	Open for details
SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0)	Open for details
SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0)	Open for details
SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM763-1 (6GK5763-1AL00-3DA0)	Open for details
SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM763-1 (6GK5763-1AL00-3AA0)	Open for details
SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0)	Open for details
SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0)	Open for details
SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM766-1 (6GK5766-1GE00-3DA0)	Open for details
SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0)	Open for details
SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) All versions affected by CVE-2023-44318	Currently no fix is planned
SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0)	Open for details
SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) All versions < V3.0.0 affected by multiple CVEs CVE-2023-44317 CVE-2023-44319 CVE-2023-44374	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/
SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) All versions affected by CVE-2023-44318	Currently no fix is planned

WORKAROUNDS AND MITIGATIONS

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

SCALANCE W-700 products are wireless communication devices based on IEEE 802.11ax or 802.11n standard. They are used to connect all to sorts of WLAN devices (Access Points or Clients, depending on the operating mode) with a strong focus on industrial components, like Programmable Logic Controllers (PLCs) or Human Machine Interfaces (HMIs) and others.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2023-44317

Affected products do not properly validate the content of uploaded X509 certificates which could allow an attacker with administrative privileges to execute arbitrary code on the device.

CVSS v3.1 Base Score	7.2
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score	8.6
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE	CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data

Vulnerability CVE-2023-44318

Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.

CVSS v3.1 Base Score	4.9
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0 Base Score	6.9
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CWE	CWE-321: Use of Hard-coded Cryptographic Key

Vulnerability CVE-2023-44319

Affected devices use a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.

CVSS v3.1 Base Score	4.9
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0 Base Score	6.9
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE	CWE-328: Use of Weak Hash

Vulnerability CVE-2023-44374

Affected devices allow to change the password, but insufficiently check which password is to be changed. With this an authenticated attacker could, under certain conditions, be able to change the password of another, potential admin user, which could allow to escalate privileges.

CVSS v3.1 Base Score	6.5
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0 Base Score	7.1
CVSS v4.0 Vector	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CWE	CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2024-06-11):	Publication Date
V1.1 (2024-09-10):	Move CVE-2023-44373 to SSA-721642 as fixed in V2.4 and remove CVE-2023-49691 as products are not affected
V1.2 (2025-01-14):	Added fix for CVE-2023-44317, CVE-2023-44319, CVE-2024-44374; added CVSSv4 vectors for all CVE IDs; removed CVE-2022-46144 as this is addressed in SSA-413565 and was fixed in V2.0.0

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.