QID 591397

Date Published: 2023-04-03

QID 591397: Siemens Scalance W-7xx (a/b/g) Product Family Improper Authentication Multiple Vulnerabilities (SSA-120908, icsa-13-213-01)

AFFECTED PRODUCTS
Firmware version prior to V4.5.4 is affected for the following products
SCALANCE W744-1, W746-1, W747-1
SCALANCE W744-1PRO, W746-1PRO, W747-1RR
SCALANCE W784-1, W784-1RR
SCALANCE W786-1PRO, W786-2PRO, W786-3PRO, W786-2RR
SCALANCE W788-1PRO, W788-2PRO, W788-1RR, W788-2RR
Alternatively, the affected products may be identified by using their MLFB. Products with the following MLFBs are affected ("x" represents a wild-card symbol):
6GK5 7xx-xAxx0-xAx0
6GK5 7xx-xBxx0-xAx0
6GK5 746-1AA60-4BA0

QID Detection Logic:
This QID checks for the Vulnerable version of Siemens Scalance W-7xx (a/b/g) Product Family using passive scanning.

Successful exploitation of these vulnerabilities may result in an attacker being able to perform a man-in-the-middle attack or gain complete control of the system.

CVSS V3 rated as Critical - 9.8 severity.

CVSS V2 rated as Critical - 10 severity.

Solution

Customers are advised to refer to CERT MITIGATIONS section ICSA-13-213-01 or Siemens MITIGATIONS section SSA-120908 for affected packages and patching details.

Vendor References

ssa-120908 - cert-portal.siemens.com/productcert/pdf/ssa-120908.pdf

CVEs related to QID 591397

CVE-2013-4651 | CVE-2013-4652 |

Software Advisories

Advisory ID	Software	Component	Link
ICSA-13-213-01			www.cisa.gov/news-events/ics-advisories/icsa-13-213-01
SSA-120908			cert-portal.siemens.com/productcert/pdf/ssa-120908.pdf

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].