PT-2023-6991 · Siemens · Scalance Wam763-1+14

Published

2023-11-14

·

Updated

2025-01-15

·

CVE-2023-44319

CVSS v4.0

6.9

Medium

VectorAV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions SCALANCE M804PB versions prior to V8.0 SCALANCE M812-1 ADSL-Router versions prior to V8.0 SCALANCE M816-1 ADSL-Router versions prior to V8.0 SCALANCE M826-2 SHDSL-Router versions prior to V8.0 SCALANCE M874-2 versions prior to V8.0 SCALANCE M874-3 versions prior to V8.0 SCALANCE M876-3 versions prior to V8.0 SCALANCE M876-4 versions prior to V8.0 SCALANCE MUM853-1 versions prior to V8.0 SCALANCE MUM856-1 versions prior to V8.0 SCALANCE S615 EEC LAN-Router versions prior to V8.0 SCALANCE S615 LAN-Router versions prior to V8.0 SCALANCE WAB762-1 versions prior to V3.0.0 SCALANCE WAM763-1 versions prior to V3.0.0 SCALANCE WAM766-1 versions prior to V3.0.0 SCALANCE WUB762-1 versions prior to V3.0.0 SCALANCE WUM763-1 versions prior to V3.0.0 SCALANCE WUM766-1 versions prior to V3.0.0 SCALANCE XB205-3 versions prior to V4.5
Description The issue is related to the use of a weak checksum algorithm to protect the configuration backup in affected devices. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.
Recommendations For SCALANCE M804PB versions prior to V8.0, update to version V8.0 or later. For SCALANCE M812-1 ADSL-Router versions prior to V8.0, update to version V8.0 or later. For SCALANCE M816-1 ADSL-Router versions prior to V8.0, update to version V8.0 or later. For SCALANCE M826-2 SHDSL-Router versions prior to V8.0, update to version V8.0 or later. For SCALANCE M874-2 versions prior to V8.0, update to version V8.0 or later. For SCALANCE M874-3 versions prior to V8.0, update to version V8.0 or later. For SCALANCE M876-3 versions prior to V8.0, update to version V8.0 or later. For SCALANCE M876-4 versions prior to V8.0, update to version V8.0 or later. For SCALANCE MUM853-1 versions prior to V8.0, update to version V8.0 or later. For SCALANCE MUM856-1 versions prior to V8.0, update to version V8.0 or later. For SCALANCE S615 EEC LAN-Router versions prior to V8.0, update to version V8.0 or later. For SCALANCE S615 LAN-Router versions prior to V8.0, update to version V8.0 or later. For SCALANCE WAB762-1 versions prior to V3.0.0, update to version V3.0.0 or later. For SCALANCE WAM763-1 versions prior to V3.0.0, update to version V3.0.0 or later. For SCALANCE WAM766-1 versions prior to V3.0.0, update to version V3.0.0 or later. For SCALANCE WUB762-1 versions prior to V3.0.0, update to version V3.0.0 or later. For SCALANCE WUM763-1 versions prior to V3.0.0, update to version V3.0.0 or later. For SCALANCE WUM766-1 versions prior to V3.0.0, update to version V3.0.0 or later. For SCALANCE XB205-3 versions prior to V4.5, update to version V4.5 or later.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-328

Related Identifiers

BDU:2023-08010
CVE-2023-44319

Affected Products

Scalance M804Pb
Scalance M812-1 Adsl-Router
Scalance M816-1 Adsl-Router
Scalance M826-2 Shdsl-Router
Scalance M874-2
Scalance M874-3
Scalance M876-3
Scalance M876-4
Scalance Mum853-1
Scalance Mum856-1
Scalance S615 Eec Lan-Router
Scalance Wab762-1
Scalance Wam763-1
Scalance Wam766-1
Scalance Xb205-3