Siemens SIMATIC and SCALANCE Use After Free (CVE-2023-3776)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(504445);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2023-3776");
  script_xref(name:"ICSA", value:"24-046-11");

  script_name(english:"Siemens SIMATIC and SCALANCE Use After Free (CVE-2023-3776)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"A use-after-free vulnerability in the Linux kernel's net/sched: cls_fw
component can be exploited to achieve local privilege escalation.
If tcf_change_indev() fails, fw_set_parms() will immediately return an
error after incrementing or decrementing the reference counter in
tcf_bind_filter(). If an attacker can control the reference counter
and set it to zero, they can cause the reference to be freed, leading
to a use-after-free vulnerability.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-831302.pdf");
  script_set_attribute(attribute:"see_also", value:"https://cert-portal.siemens.com/productcert/pdf/ssa-806742.pdf");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109945851/");
  script_set_attribute(attribute:"see_also", value:"https://support.industry.siemens.com/cs/ww/en/view/109826613/");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-24-046-11");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Siemens has released update V2.4 for SCALANCE X-300 and recommends updating to the latest version.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To
operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens'
operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-806742 in HTML and CSAF.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-3776");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_cwe_id(416);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/06/13");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/14");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xch328_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm324_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm328_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xcm332_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:2.4");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:siemens:simatic_s7-1500_tm_mfp_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Siemens");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Siemens');

var asset = tenable_ot::assets::get(vendor:'Siemens');

var vuln_cpes = {
    "cpe:/o:siemens:simatic_s7-1500_tm_mfp_firmware" :
        {"versionEndExcluding" : "1.3.0", "family" : "S71500", "orderNumbers": ["6ES7558-1AA00-0AB0"]},
    "cpe:/o:siemens:scalance_xch328_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2EC2']},
    "cpe:/o:siemens:scalance_xcm324_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5324-8TS01-2AC2']},
    "cpe:/o:siemens:scalance_xcm328_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5328-4TS01-2AC2']},
    "cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2ER3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-3AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-2AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-3TS01-4AR3']},
    "cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5334-2TS01-4AR3']},
    "cpe:/o:siemens:scalance_xcm332_firmware:2.4" :
        {"versionEndExcluding" : "2.4", "family" : "SCALANCEX300", "orderNumbers" : ['6GK5332-0GA01-2AC2']}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);