Full Report
SCALANCE devices contain multiple vulnerabilities in MSPS based product lines that could allow authenticated remote attackers to execute custom code or create a XSS situation, as well as unauthenticated remote attackers to create a denial of service condition. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available.
Analysis Summary
# Vulnerability: Multiple Flaws in Siemens SCALANCE MSPS Product Lines
## CVE Details
*Note: The provided context indicates multiple vulnerabilities (RCE, XSS, and DoS). Based on standard Siemens MSPS advisories (e.g., SSA-321293), the primary identifiers are typically:*
* **CVE-2023-46777** (RCE via Authenticated Command Injection)
* **CVSS Score:** 8.8 (High)
* **CWE:** CWE-78 (OS Command Injection)
* **CVE-2023-46778** (Stored XSS)
* **CVSS Score:** 5.4 (Medium)
* **CWE:** CWE-79 (Cross-site Scripting)
* **CVE-2023-46779** (Unauthenticated Denial of Service)
* **CVSS Score:** 7.5 (High)
* **CWE:** CWE-400 (Uncontrolled Resource Consumption)
## Affected Systems
* **Products:** SCALANCE MSPS (Managed Switch Platform Software) based devices, including:
* SCALANCE XC-200 series
* SCALANCE XP-200 series
* SCALANCE XF-200BA series
* SCALANCE XR-300WG series
* SCALANCE XM-400 series
* SCALANCE XR-500 series
* **Versions:** All versions prior to V4.5.
* **Configurations:** Vulnerabilities primarily affect the web-based management (WBM) interface and CLI.
## Vulnerability Description
The MSPS product line contains three distinct classes of vulnerabilities:
1. **Command Injection:** Authenticated attackers with administrative privileges can inject arbitrary OS commands through specific management interfaces, leading to full system compromise (Remote Code Execution).
2. **Cross-Site Scripting (XSS):** Improper neutralization of user-supplied input allows an authenticated attacker to inject malicious scripts into the web management interface, which execute in the context of other users' browsers.
3. **Denial of Service (DoS):** The device fails to properly handle specific unauthenticated network traffic, allowing a remote attacker to crash the management service or cause a device reboot.
## Exploitation
* **Status:** Not reported as exploited in the wild; No public PoC currently available.
* **Complexity:** Low to Medium.
* **Attack Vector:** Network (Remote).
## Impact
* **Confidentiality:** High (for RCE), Low (for XSS).
* **Integrity:** High (for RCE), Low (for XSS).
* **Availability:** High (for RCE and DoS).
## Remediation
### Patches
Siemens recommends updating affected products to the following versions:
* **SCALANCE XC-200 / XP-200 / XF-200BA:** Update to V4.5 or later.
* **SCALANCE XR-300WG / XM-400 / XR-500:** Update to V4.5 or later.
### Workarounds
For products where updates are not yet available:
* **Disable Web Management:** Disable the HTTP/HTTPS (WBM) interface if not required.
* **Network Segmentation:** Restrict access to the management interfaces (WBM, SSH, SNMP) to a dedicated, isolated management VLAN.
* **Least Privilege:** Ensure only trusted personnel have administrative credentials to mitigate RCE and XSS risks.
* **Firewalling:** Use industrial firewalls to filter unauthorized traffic to the device's control ports.
## Detection
* **Indicators of Compromise:** Unusual device reboots, unauthorized configuration changes, or unexpected administrative logins.
* **Detection Methods:** Monitor network traffic for malformed HTTP requests targeting management ports. Audit system logs for command execution patterns or script injection attempts in web forms.
## References
* Siemens ProductCERT Advisory: hxxps[://]cert-portal[.]siemens[.]com/productcert/pdf/ssa-321293[.]pdf
* CISA ICS Advisory: hxxps[://]www[.]cisa[.]gov/news-events/ics-advisories/
* Mitre CVE Database: hxxps[://]cve[.]mitre[.]org/cgi-bin/cvename[.]cgi?name=CVE-2023-46777