CVE-2023-44318
Siemens · published 2023-11-14
Source record Collected from the National Vulnerability Database (NVD)
Description
Description by Siemens AG via the CVE Program.
Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that obtains a configuration backup to extract configuration information from the exported file.
Status at the source
- NVD status: Modified
Affected products, as the source lists them
| Vendor | Product | Versions |
|---|---|---|
| Siemens | RUGGEDCOM RM1224 LTE(4G) EU | 0 – before *: affected |
| Siemens | RUGGEDCOM RM1224 LTE(4G) NAM | 0 – before *: affected |
| Siemens | SCALANCE M804PB | 0 – before *: affected |
| Siemens | SCALANCE M812-1 ADSL-Router | 0 – before *: affected |
| Siemens | SCALANCE M812-1 ADSL-Router | 0 – before *: affected |
| Siemens | SCALANCE M816-1 ADSL-Router | 0 – before *: affected |
| Siemens | SCALANCE M816-1 ADSL-Router | 0 – before *: affected |
| Siemens | SCALANCE M826-2 SHDSL-Router | 0 – before *: affected |
| Siemens | SCALANCE M874-2 | 0 – before *: affected |
| Siemens | SCALANCE M874-3 | 0 – before *: affected |
| Siemens | SCALANCE M876-3 | 0 – before *: affected |
| Siemens | SCALANCE M876-3 (ROK) | 0 – before *: affected |
| Siemens | SCALANCE M876-4 | 0 – before *: affected |
| Siemens | SCALANCE M876-4 (EU) | 0 – before *: affected |
| Siemens | SCALANCE M876-4 (NAM) | 0 – before *: affected |
| Siemens | SCALANCE MUM853-1 (EU) | 0 – before *: affected |
| Siemens | SCALANCE MUM856-1 (EU) | 0 – before *: affected |
| Siemens | SCALANCE MUM856-1 (RoW) | 0 – before *: affected |
| Siemens | SCALANCE S615 EEC LAN-Router | 0 – before *: affected |
| Siemens | SCALANCE S615 LAN-Router | 0 – before *: affected |
| Siemens | SCALANCE XB205-3 (SC, PN) | 0 – before *: affected |
| Siemens | SCALANCE XB205-3 (ST, E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB205-3 (ST, E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB205-3 (ST, PN) | 0 – before *: affected |
| Siemens | SCALANCE XB205-3LD (SC, E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB205-3LD (SC, PN) | 0 – before *: affected |
| Siemens | SCALANCE XB206-2 (SC) | 0 – before *: affected |
| Siemens | SCALANCE XB206-2 (ST/BFOC) | 0 – before *: affected |
| Siemens | SCALANCE XB206-2 LD | 0 – before *: affected |
| Siemens | SCALANCE XB206-2 SC | 0 – before *: affected |
| Siemens | SCALANCE XB206-2 ST | 0 – before *: affected |
| Siemens | SCALANCE XB206-2LD | 0 – before *: affected |
| Siemens | SCALANCE XB208 (E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB208 (PN) | 0 – before *: affected |
| Siemens | SCALANCE XB213-3 (SC, E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB213-3 (SC, PN) | 0 – before *: affected |
| Siemens | SCALANCE XB213-3 (ST, E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB213-3 (ST, PN) | 0 – before *: affected |
| Siemens | SCALANCE XB213-3LD (SC, E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB213-3LD (SC, PN) | 0 – before *: affected |
| Siemens | SCALANCE XB216 (E/IP) | 0 – before *: affected |
| Siemens | SCALANCE XB216 (PN) | 0 – before *: affected |
| Siemens | SCALANCE XC206-2 (SC) | 0 – before *: affected |
| Siemens | SCALANCE XC206-2 (ST/BFOC) | 0 – before *: affected |
| Siemens | SCALANCE XC206-2G PoE | 0 – before *: affected |
| Siemens | SCALANCE XC206-2G PoE (54 V DC) | 0 – before *: affected |
| Siemens | SCALANCE XC206-2G PoE EEC (54 V DC) | 0 – before *: affected |
| Siemens | SCALANCE XC206-2SFP | 0 – before *: affected |
| Siemens | SCALANCE XC206-2SFP EEC | 0 – before *: affected |
| Siemens | SCALANCE XC206-2SFP G | 0 – before *: affected |
| Siemens | SCALANCE XC206-2SFP G (EIP DEF.) | 0 – before *: affected |
| Siemens | SCALANCE XC206-2SFP G EEC | 0 – before *: affected |
| Siemens | SCALANCE XC208 | 0 – before *: affected |
| Siemens | SCALANCE XC208EEC | 0 – before *: affected |
| Siemens | SCALANCE XC208G | 0 – before *: affected |
| Siemens | SCALANCE XC208G (EIP def.) | 0 – before *: affected |
| Siemens | SCALANCE XC208G EEC | 0 – before *: affected |
| Siemens | SCALANCE XC208G PoE | 0 – before *: affected |
| Siemens | SCALANCE XC208G PoE (54 V DC) | 0 – before *: affected |
| Siemens | SCALANCE XC216 | 0 – before *: affected |
| Siemens | SCALANCE XC216-3G PoE | 0 – before *: affected |
| Siemens | SCALANCE XC216-3G PoE (54 V DC) | 0 – before *: affected |
| Siemens | SCALANCE XC216-4C | 0 – before *: affected |
| Siemens | SCALANCE XC216-4C G | 0 – before *: affected |
| Siemens | SCALANCE XC216-4C G (EIP Def.) | 0 – before *: affected |
| Siemens | SCALANCE XC216-4C G EEC | 0 – before *: affected |
| Siemens | SCALANCE XC216EEC | 0 – before *: affected |
| Siemens | SCALANCE XC224 | 0 – before *: affected |
| Siemens | SCALANCE XC224-4C G | 0 – before *: affected |
| Siemens | SCALANCE XC224-4C G (EIP Def.) | 0 – before *: affected |
| Siemens | SCALANCE XC224-4C G EEC | 0 – before *: affected |
| Siemens | SCALANCE XF204 | 0 – before *: affected |
| Siemens | SCALANCE XF204 DNA | 0 – before *: affected |
| Siemens | SCALANCE XF204-2BA | 0 – before *: affected |
| Siemens | SCALANCE XF204-2BA DNA | 0 – before *: affected |
| Siemens | SCALANCE XF204G | 0 – before *: affected |
| Siemens | SCALANCE XP208 | 0 – before *: affected |
| Siemens | SCALANCE XP208 | 0 – before *: affected |
| Siemens | SCALANCE XP208 (Ethernet/IP) | 0 – before *: affected |
| Siemens | SCALANCE XP208EEC | 0 – before *: affected |
| Siemens | SCALANCE XP208EEC | 0 – before *: affected |
| Siemens | SCALANCE XP208G | 0 – before *: affected |
| Siemens | SCALANCE XP208G EEC | 0 – before *: affected |
| Siemens | SCALANCE XP208G PoE EEC | 0 – before *: affected |
| Siemens | SCALANCE XP208G PP | 0 – before *: affected |
| Siemens | SCALANCE XP208PoE EEC | 0 – before *: affected |
| Siemens | SCALANCE XP208PoE EEC | 0 – before *: affected |
| Siemens | SCALANCE XP216 | 0 – before *: affected |
| Siemens | SCALANCE XP216 (Ethernet/IP) | 0 – before *: affected |
| Siemens | SCALANCE XP216 (V2) | 0 – before *: affected |
| Siemens | SCALANCE XP216EEC | 0 – before *: affected |
| Siemens | SCALANCE XP216EEC (V2) | 0 – before *: affected |
| Siemens | SCALANCE XP216G | 0 – before *: affected |
| Siemens | SCALANCE XP216G EEC | 0 – before *: affected |
| Siemens | SCALANCE XP216G PoE EEC | 0 – before *: affected |
| Siemens | SCALANCE XP216POE EEC | 0 – before *: affected |
| Siemens | SCALANCE XP216PoE EEC (V2) | 0 – before *: affected |
| Siemens | SCALANCE XR324WG (24 x FE, AC 230V) | 0 – before *: affected |
| Siemens | SCALANCE XR324WG (24 X FE, DC 24V) | 0 – before *: affected |
| Siemens | SCALANCE XR326-2C PoE WG | 0 – before *: affected |
The source lists more products than DeSpy shows; see the source record.
Products named in NVD's CPE match criteria (50)
cpe:2.3:o:siemens:6gk5205-3bb00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5205-3bb00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5205-3bd00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5205-3bd00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5205-3bf00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5205-3bf00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ba00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ba00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5213-3bd00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5213-3bd00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5213-3bb00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5213-3bb00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5213-3bf00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5213-3bf00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-0ba00-2tb2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-0ba00-2ab2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2bd00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2bb00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2rs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2rs00-5ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2rs00-5fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2bs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2bs00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2gs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2gs00-2tc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5206-2gs00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ba00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ba00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ga00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ga00-2tc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ga00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ra00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ra00-5ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-0ba00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-3rs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-3rs00-5ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-4bs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-4gs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-4gs00-2tc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-4gs00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5216-0ba00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5224-0ba00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5224-4gs00-2ac2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5224-4gs00-2tc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5224-4gs00-2fc2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5204-0ba00-2gf2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5204-0ba00-2yf2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5204-2aa00-2gf2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5204-2aa00-2yf2_firmware:*:*:*:*:*:*:*:*cpe:2.3:o:siemens:6gk5208-0ha00-2as6_firmware:*:*:*:*:*:*:*:*
DeSpy has not checked any unit, hardware revision or firmware. A product missing here is not a statement that it is unaffected.
Scores, as their sources published them
- CVSS 4.0: 6.9 MEDIUM — as published by Siemens AG (Secondary)
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1: 4.9 MEDIUM — as published by Siemens AG (Secondary)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 3.1: 4.9 MEDIUM — as published by NIST (Primary)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - SSVC — CISA's assessment (SSVC 2.0.3, CISA Coordinator): Exploitation: none · Automatable: yes · Technical impact: total
DeSpy does not score records. These are the sources' own values.
Weaknesses
Sources
References the source lists
- https://cert-portal.siemens.com/productcert/html/ssa-180704.html
- https://cert-portal.siemens.com/productcert/html/ssa-353002.html
- https://cert-portal.siemens.com/productcert/html/ssa-690517.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-180704.html
- https://cert-portal.siemens.com/productcert/html/ssa-353002.html
- https://cert-portal.siemens.com/productcert/html/ssa-690517.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-180704.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-699386.pdf
Source dates: published 2023-11-14, last changed 2026-06-17. DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.