PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-2194 Siemens CVE debrief

CVE-2023-2194 is an out-of-bounds write in the Linux kernel SLIMpro I2C device driver as exposed in Siemens SCALANCE W700 wireless products. According to the advisory, a userspace value, data->block[0], was not constrained to 0-255 and was used as the length for memcpy, which could write past the end of dma_buffer. Siemens and CISA describe the impact as a possible local crash and, in the worst case, code execution by a local privileged user. Siemens provides a fixed release, and CISA published the advisory on 2025-02-11 with a later typo-only revision on 2025-05-06.

Vendor
Siemens
Product
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2025-02-11
Original CVE updated
2025-05-06
Advisory published
2025-02-11
Advisory updated
2025-05-06

Who should care

Operators, administrators, and support teams responsible for the affected Siemens SCALANCE WAB/WAM/WUB/WUM wireless devices should prioritize this issue, especially in industrial and OT environments where privileged local access may exist.

Technical summary

The flaw is a bounds-checking failure in the Linux kernel SLIMpro I2C driver. A userspace-controlled byte, data->block[0], was not limited to the expected 0-255 range before being used as the size argument to memcpy. That can produce an out-of-bounds write beyond dma_buffer. The advisory rates the issue CVSS 3.1 6.7/Medium with local attack vector, high privileges required, and high integrity/availability impact.

Defensive priority

High for exposed affected assets. The attack requires local privileged access, but the consequence is memory corruption with potential system crash or code execution, and vendor remediation is available.

Recommended defensive actions

  • Update affected Siemens products to V3.0.0 or later, per the vendor remediation guidance.
  • Inventory the listed SCALANCE models to confirm whether any affected product IDs are deployed.
  • Limit and monitor privileged local access on affected devices until remediation is complete.
  • Apply changes during a maintenance window and verify device stability after updating.
  • Use established ICS defense-in-depth and segmentation practices to reduce the impact of local compromise.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-044-09 and the linked Siemens advisory materials. The source text states the vulnerability is an out-of-bounds write in the Linux kernel SLIMpro I2C driver, caused by an uncapped data->block[0] value used in memcpy, with possible crash or code execution. The advisory publication date used here is 2025-02-11, and the 2025-05-06 revision is described as typo fixes only.

Official resources

CISA published the advisory on 2025-02-11 and later revised it on 2025-05-06 for typo corrections. The underlying CVE is CVE-2023-2194.