Full Report
SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Flaws in SCALANCE W-700 IEEE 802.11n Family
## CVE Details
* **CVE IDs:** CVE-2020-24588, CVE-2020-26139, CVE-2020-26140, CVE-2020-26141, CVE-2020-26143, CVE-2020-26144, CVE-2020-26146, CVE-2020-26147, CVE-2021-3712, CVE-2022-0778, CVE-2022-31765, CVE-2022-36323, CVE-2022-36324, CVE-2022-36325, CVE-2023-44373.
* **CVSS Score:** 9.1 (Critical) / CVSS v4.0: 9.4 (Critical)
* **CWEs:** CWE-835 (Infinite Loop), CWE-862 (Missing Authorization), CWE-74 (Injection), CWE-770 (Resource Allocation), CWE-80 (XSS).
## Affected Systems
* **Products:** Siemens SCALANCE W-700 IEEE 802.11n family (e.g., W721-1 RJ45, W722-1 RJ45).
* **Versions:** All firmware versions prior to V6.6.0.
* **Configurations:** Devices utilizing the web-based management interface, SSL/TLS renegotiation, or processing external certificates/keys.
## Vulnerability Description
This advisory covers a wide range of vulnerabilities including "FragAttacks" (WiFi fragmentation/aggregation flaws), OpenSSL vulnerabilities, and web interface flaws. Key technical issues include:
* **Infinite Loop (CVE-2022-0778):** Triggered in OpenSSL during certificate parsing with invalid elliptic curve parameters, leading to Denial of Service (DoS).
* **Missing Authorization (CVE-2022-31765):** The web interface fails to properly authorize password changes, allowing low-privileged users to escalate privileges.
* **Code Injection (CVE-2022-36323):** Improper input sanitization allows an authenticated admin to inject code or spawn a root shell.
* **DoS (CVE-2022-36324):** Flaws in SSL/TLS renegotiation allow attackers to bypass brute-force protection and exhaust resources.
* **FragAttacks (CVE-2020-24588 et al.):** Deficiencies in the IEEE 802.11 standard implementation regarding frame fragmentation and aggregation.
## Exploitation
* **Status:** PoC Available (designated by "E:P" in CVSS vectors for several CVEs).
* **Complexity:** Low.
* **Attack Vector:** Network.
## Impact
* **Confidentiality:** High (Data exposure via XSS/Escalation).
* **Integrity:** High (Root shell access/Unauthorized password changes).
* **Availability:** High (Denial of Service via infinite loops or resource exhaustion).
## Remediation
### Patches
* **Update to V6.6.0 or later:** Siemens has released firmware version V6.6.0 specifically to address these vulnerabilities.
* Download link: hxxps://support.industry.siemens.com/cs/ww/en/view/109996102/
### Workarounds
* Restrict network access to the web management interface to trusted IPs only.
* Ensure the latest patches for OpenSSL dependecies are applied if used in conjunction with these devices.
* Disable unnecessary features or services that utilize SSL/TLS renegotiation if not required.
## Detection
* **Indicators of Compromise:** Unexpected reboots or unresponsive web interfaces (DoS), unauthorized administrative password changes, or unusual shell activity.
* **Detection methods:** Use vulnerability scanners to identify SCALANCE devices running versions < V6.6.0. Monitor network traffic for unusual SSL/TLS renegotiation patterns or malformed IEEE 802.11 frames.
## References
* **Siemens Advisory:** hxxps://cert-portal.siemens.com/productcert/pdf/ssa-019200.pdf
* **Siemens ProductCert:** hxxps://cert-portal.siemens.com/productcert/html/ssa-019200.html