Siemens SCALANCE

SUMMARY SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Read (CVE-2023-39192)

A flaw was found in the Netfilter subsystem in the Linux kernel. The xtu32 module did not validate the fields in the xtu32 structure. This flaw allows a local privileged attacker to trigger an out-of- bounds read by setting the size fields with a value beyond the array boundaries, leading to a...

Siemens SIMATIC and SCALANCE Devices NULL Pointer Dereference (CVE-2023-42754)

A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before calling ipoptionscompile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAPNETADMIN privileges t...

Siemens SIMATIC and SCALANCE Devices Divide By Zero (CVE-2023-31085)

An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in dodivsz,mtd-erasesize, used indirectly by ctrlcdevioctl, when mtd-erasesize is 0. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Siemens SCALANCE W700 Improper Input Validation (CVE-2023-28578)

Memory corruption in Core Services while executing the command for removing a single event listener. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SCALANCE W700 Integer Overflow or Wraparound (CVE-2022-39842)

An issue was discovered in the Linux kernel before 5.19. In pxa3xxgcuwrite in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of sizet versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to...

Siemens SCALANCE W700 Improper Access Control (CVE-2025-24532)

Affected devices with role user is affected by incorrect authorization in SNMPv3 View configuration. This could allow an attacker to change the View Type of SNMPv3 Views. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

Siemens SCALANCE W700 Out-of-bounds Write (CVE-2023-1073)

A memory corruption flaw was found in the Linux kernel's human interface device HID subsystem in how a user inserts a malicious USB device. This flaw allows a local user to crash or potentially escalate their privileges on the system. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Read (CVE-2023-39193)

A flaw was found in the Netfilter subsystem in the Linux kernel. The sctpmtcheck did not validate the flagcount field. This flaw allows a local privileged CAPNETADMIN attacker to trigger an out-of- bounds read, leading to a crash or information disclosure. This plugin only works with Tenable.ot...

Siemens SCALANCE W700 Out-of-bounds Write (CVE-2023-2194)

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace data-block0 variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dmabuffer. This flaw could allow a local privileged...

Siemens SIMATIC and SCALANCE Devices Use After Free (CVE-2023-4921)

A use-after-free vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfqdequeue due to the incorrect .peek handler of...

Siemens SIMATIC and SCALANCE Devices Missing Critical Step in Authentication (CVE-2023-51384)

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS11-hosted private keys, these constraints are only applied to the first key, even if a PKCS11 token returns multiple keys. This plugin...

Siemens SIMATIC and SCALANCE Devices NULL Pointer Dereference (CVE-2022-47929)

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service system crash via a crafted traffic control configuration that is set up with tc qdisc and tc class commands. This affects qdiscgraft in...

Siemens SCALANCE W700 Externally Controlled Reference to a Resource in Another Sphere (CVE-2023-0045)

The current implementation of the prctl syscall does not issue an IBPB immediately during the syscall. The ibprctlset function updates the Thread Information Flags TIFs for the task and updates the SPECCTRL MSR on the function speculationctrlupdate, but the IBPB is only issued on the next schedul...

Siemens SCALANCE W700 Improper Restriction of Operations within the Bounds of a Memory Buffer (CVE-2024-33016)

memory corruption when an invalid firehose patch command is invoked. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid502913; scriptversion"1.3";...

Siemens SCALANCE W700 Integer Overflow or Wraparound (CVE-2023-45853)

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2023-35001)

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nftbyteorder poorly handled vm register contents when CAPNETADMIN is in any user or network namespace This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

Siemens SCALANCE W700 Uncontrolled Resource Consumption (CVE-2024-23814)

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re- assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2022-43750)

drivers/usb/mon/monbin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 8090...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2024-9143)

Use of the low-level GF2m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the...