PatchSiren

PatchSiren cyber security CVE debrief

CVE-2023-2194 Siemens CVE debrief

CVE-2023-2194 is an out-of-bounds write in the Linux kernel SLIMpro I2C device driver as exposed in Siemens SCALANCE W700 wireless products. According to the advisory, a userspace value, data->block[0], was not constrained to 0-255 and was used as the length for memcpy, which could write past the end of dma_buffer. Siemens and CISA describe the impact as a possible local crash and, in the worst case, code execution by a local privileged user. Siemens provides a fixed release, and CISA published the advisory on 2025-02-11 with a later typo-only revision on 2025-05-06.

Vendor
Siemens
Product
SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0)
CVSS
MEDIUM 6.7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-02-13
Original CVE updated
2024-02-13
Advisory published
2024-02-13
Advisory updated
2024-02-13

Who should care

Operators, administrators, and support teams responsible for the affected Siemens SCALANCE WAB/WAM/WUB/WUM wireless devices should prioritize this issue, especially in industrial and OT environments where privileged local access may exist.

Technical summary

The flaw is a bounds-checking failure in the Linux kernel SLIMpro I2C driver. A userspace-controlled byte, data->block[0], was not limited to the expected 0-255 range before being used as the size argument to memcpy. That can produce an out-of-bounds write beyond dma_buffer. The advisory rates the issue CVSS 3.1 6.7/Medium with local attack vector, high privileges required, and high integrity/availability impact.

Defensive priority

High for exposed affected assets. The attack requires local privileged access, but the consequence is memory corruption with potential system crash or code execution, and vendor remediation is available.

Recommended defensive actions

  • Update affected Siemens products to V3.0.0 or later, per the vendor remediation guidance.
  • Inventory the listed SCALANCE models to confirm whether any affected product IDs are deployed.
  • Limit and monitor privileged local access on affected devices until remediation is complete.
  • Apply changes during a maintenance window and verify device stability after updating.
  • Use established ICS defense-in-depth and segmentation practices to reduce the impact of local compromise.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-044-09 and the linked Siemens advisory materials. The source text states the vulnerability is an out-of-bounds write in the Linux kernel SLIMpro I2C driver, caused by an uncapped data->block[0] value used in memcpy, with possible crash or code execution. The advisory publication date used here is 2025-02-11, and the 2025-05-06 revision is described as typo fixes only.

Sources and references

Verified primary and authoritative sources

  • CVE-2023-2194 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2023-2194

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2023-2194 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2023-2194

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-044-09.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-769027.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-769027.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-09

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.