PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-36323 Siemens CVE debrief

CVE-2022-36323 is a critical input-sanitization issue in multiple Siemens SCALANCE wireless devices. According to the advisory corpus, an authenticated remote attacker with administrative privileges could inject code or spawn a system root shell, making compromise of the device highly consequential.

Vendor
Siemens
Product
SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0)
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-14
Original CVE updated
2026-04-21
Advisory published
2026-04-14
Advisory updated
2026-04-21

Who should care

Organizations using the affected Siemens SCALANCE W-series devices, especially teams responsible for OT network security, remote administration, and firmware management, should treat this as high priority.

Technical summary

The supplied advisory describes an improper sanitization of an input field in multiple SCALANCE models. The impact is code injection or root-level shell access, but the attack requires network access and administrative privileges (CVSS v3.1: AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1).

Defensive priority

High. Even though administrative privileges are required, successful exploitation can yield root-level control of an affected industrial device. Prioritize any exposed or remotely managed SCALANCE systems and confirm they are on a fixed release.

Recommended defensive actions

  • Update affected devices to V6.6.0 or later, as directed by the vendor advisory.
  • Inventory SCALANCE devices and verify whether any listed models are deployed in your environment.
  • Restrict and monitor administrative access to device management interfaces.
  • Review OT segmentation and limit network paths to device administration services.
  • Use the Siemens advisory and CISA advisory references to confirm model-specific remediation steps and deployment guidance.

Evidence notes

This debrief is based on the supplied CISA CSAF advisory (ICSA-26-111-07) republishing Siemens ProductCERT SSA-019200 and the linked Siemens/CISA references. The corpus states the vulnerability is caused by improper input sanitization and can allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. The remediation listed in the corpus is to update to V6.6.0 or later. No KEV listing was provided in the source corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-36323 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-36323

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-36323 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-36323

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-111-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-019200.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-019200.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-26-111-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.