SSA-697140

Siemens Security Advisory by Siemens ProductCERT

SSA-697140: Denial of Service Vulnerability in the TCP Event Service of SCALANCE and RUGGEDCOM Products

Publication Date:	2022-10-11
Last Update:	2025-02-11
Current Version:	V1.3
CVSS v3.1 Base Score:	8.6

SUMMARY

The products listed below contain a denial of service vulnerability in the TCP event interface that could allow an unauthenticated remote attacker to render the device unusable.

Siemens has released updates for the affected products and recommends to update to the latest versions.

AFFECTED PRODUCTS AND SOLUTION

Un-/Collapse All

Affected Product and Versions	Remediation
SCALANCE M-800 family (incl. S615, MUM-800 and RM1224)	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
RUGGEDCOM RM1224 family (6GK6108-4AM00)	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M-800 family	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M804PB (6GK5804-0AP00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M812-1 ADSL-Router family	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M816-1 ADSL-Router family	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M874-2 (6GK5874-2AA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M874-3 (6GK5874-3AA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M876-3 (6GK5876-3AA02-2BA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M876-4 (6GK5876-4AA10-2BA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE MUM-800 family	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE S615 family	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) All versions < V7.1.2 affected by CVE-2022-31766	Update to V7.1.2 or later version https://support.industry.siemens.com/cs/ww/en/view/109813051/ See further recommendations from section Workarounds and Mitigations
SCALANCE W-700 IEEE 802.11ax family	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations
SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) All versions >= V1.1.0 < V3.0.0 affected by CVE-2022-31766	Update to V3.0.0 or later version https://support.industry.siemens.com/cs/ww/en/view/109977720/ See further recommendations from section Workarounds and Mitigations

WORKAROUNDS AND MITIGATIONS

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

Deactivate the TCP Event feature (not active by default)
Restrict access to the TCP Event Service port (default 26864/tcp) to trusted networks and client IP addresses

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

SCALANCE M-800, MUM-800 and S615 as well as the RUGGEDCOM RM1224 are industrial routers.

SCALANCE W-1700 products are wireless communication devices based on IEEE 802.11ac standard. They are used to connect all to sorts of WLAN devices (Access Points or Clients, depending on the operating mode) with a strong focus on industrial components, like Programmable Logic Controllers (PLCs) or Human Machine Interfaces (HMIs) and others.

SCALANCE W-700 products are wireless communication devices based on IEEE 802.11ax or 802.11n standard. They are used to connect all to sorts of WLAN devices (Access Points or Clients, depending on the operating mode) with a strong focus on industrial components, like Programmable Logic Controllers (PLCs) or Human Machine Interfaces (HMIs) and others.

SCALANCE X switches are used to connect industrial components like Programmable Logic Controllers (PLCs) or Human Machine Interfaces (HMIs).

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2022-31766

Affected devices with TCP Event service enabled do not properly handle malformed packets. This could allow an unauthenticated remote attacker to cause a denial of service condition and reboot the device thus possibly affecting other network resources.

CVSS v3.1 Base Score	8.6
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:P/RL:O/RC:C
CWE	CWE-20: Improper Input Validation

ACKNOWLEDGMENTS

Siemens thanks the following party for its efforts:

Martin Grubhofer and Michael Messner from Siemens Energy for reporting the vulnerability

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2022-10-11):	Publication Date
V1.1 (2023-01-10):	Added fix for SCALANCE W-700 IEEE 802.11ax product family
V1.2 (2023-03-14):	Added missing affected products SCALANCE S615 EEC (6GK5615-0AA01-2AA2) and SCALANCE M876-4 (6GK5876-4AA10-2BA2)
V1.3 (2025-02-11):	Corrected fix for CVE-2022-31766 for SCALANCE W-700 IEEE 802.11ax family devices

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.