CVE-2022-2663 Siemens CVE debrief

Who should care

Organizations operating Siemens SCALANCE WAB/WAM/WUB/WUM wireless devices, especially OT/ICS teams, network and firewall administrators, and anyone permitting IRC traffic across segmented networks. The risk is most relevant where unencrypted IRC is allowed and connection tracking for IRC is enabled.

Technical summary

The underlying flaw is in Linux kernel nf_conntrack_irc, where IRC message handling can be confused and a message may be matched incorrectly. In the Siemens advisory, the practical security impact is a potential firewall bypass in environments that use unencrypted IRC with nf_conntrack_irc configured. The CSAF advisory maps this issue to 19 Siemens SCALANCE product variants and assigns a CVSS v3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Defensive priority

Medium priority for exposed Siemens SCALANCE deployments; prioritize quickly if unencrypted IRC is allowed or if the affected devices sit on trusted network boundaries.

Recommended defensive actions

• Update affected Siemens SCALANCE devices to V3.0.0 or later using the vendor guidance.
• Inventory all listed SCALANCE WAB/WAM/WUB/WUM variants and confirm firmware versions.
• Review whether unencrypted IRC is permitted anywhere in the environment; if not required, block it at network controls.
• Verify that nf_conntrack_irc is only enabled where operationally necessary and is covered by compensating controls.
• Recheck firewall and segmentation rules around OT/ICS zones to ensure IRC cannot traverse trust boundaries unexpectedly.
• Use Siemens and CISA advisory references to confirm product applicability and remediation status before scheduling maintenance.

Evidence notes

Source evidence comes from CISA CSAF ICSA-25-044-09 and Siemens advisory SSA-769027. The advisory states that the issue can be confused in nf_conntrack_irc and may permit firewall bypass when users are using unencrypted IRC with nf_conntrack_irc configured. The remediations section specifies updating to V3.0.0 or later for the affected Siemens SCALANCE products. No Known Exploited Vulnerabilities (KEV) entry was supplied.

Official resources