PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-2663 Siemens CVE debrief

CVE-2022-2663 describes a Linux kernel nf_conntrack_irc message-handling issue that can cause IRC traffic to be matched incorrectly. In Siemens’ advisory context, this could allow a firewall bypass when unencrypted IRC is used and nf_conntrack_irc is configured. Siemens lists multiple SCALANCE W-series products as affected and recommends updating to V3.0.0 or later.

Vendor
Siemens
Product
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2023-06-13
Original CVE updated
2024-04-09
Advisory published
2023-06-13
Advisory updated
2024-04-09

Who should care

Organizations operating Siemens SCALANCE WAB/WAM/WUB/WUM wireless devices, especially OT/ICS teams, network and firewall administrators, and anyone permitting IRC traffic across segmented networks. The risk is most relevant where unencrypted IRC is allowed and connection tracking for IRC is enabled.

Technical summary

The underlying flaw is in Linux kernel nf_conntrack_irc, where IRC message handling can be confused and a message may be matched incorrectly. In the Siemens advisory, the practical security impact is a potential firewall bypass in environments that use unencrypted IRC with nf_conntrack_irc configured. The CSAF advisory maps this issue to 19 Siemens SCALANCE product variants and assigns a CVSS v3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Defensive priority

Medium priority for exposed Siemens SCALANCE deployments; prioritize quickly if unencrypted IRC is allowed or if the affected devices sit on trusted network boundaries.

Recommended defensive actions

  • Update affected Siemens SCALANCE devices to V3.0.0 or later using the vendor guidance.
  • Inventory all listed SCALANCE WAB/WAM/WUB/WUM variants and confirm firmware versions.
  • Review whether unencrypted IRC is permitted anywhere in the environment; if not required, block it at network controls.
  • Verify that nf_conntrack_irc is only enabled where operationally necessary and is covered by compensating controls.
  • Recheck firewall and segmentation rules around OT/ICS zones to ensure IRC cannot traverse trust boundaries unexpectedly.
  • Use Siemens and CISA advisory references to confirm product applicability and remediation status before scheduling maintenance.

Evidence notes

Source evidence comes from CISA CSAF ICSA-25-044-09 and Siemens advisory SSA-769027. The advisory states that the issue can be confused in nf_conntrack_irc and may permit firewall bypass when users are using unencrypted IRC with nf_conntrack_irc configured. The remediations section specifies updating to V3.0.0 or later for the affected Siemens SCALANCE products. No Known Exploited Vulnerabilities (KEV) entry was supplied.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-2663 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-2663

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-2663 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-2663

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-044-09.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-769027.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-769027.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.