CVE-2023-44374 Siemens CVE debrief

Who should care

Organizations operating Siemens SCALANCE W700 series wireless access points in industrial environments, particularly those in critical infrastructure sectors. System administrators responsible for OT/ICS network security, security operations centers monitoring industrial networks, and compliance teams tracking CVE remediation for industrial assets should prioritize this update.

Technical summary

CVE-2023-44374 is an authorization vulnerability in Siemens SCALANCE W700 series wireless access points. The device's password change functionality fails to properly validate which user's password is being modified, allowing an authenticated attacker to potentially change another user's password—including administrative accounts—leading to privilege escalation. The vulnerability requires network access and valid credentials but no user interaction. Affected products include 19 variants of SCALANCE WAB762-1, WAM763-1, WAM766-1, WUB762-1, WUM763-1, and WUM766-1 devices. Siemens released firmware version 3.0.0 to remediate this vulnerability.

Defensive priority

medium

Recommended defensive actions

• Update affected SCALANCE W700 devices to firmware version 3.0.0 or later
• Review and audit user accounts with administrative privileges on affected devices
• Implement network segmentation to limit access to device management interfaces
• Monitor for unauthorized password change attempts in device logs
• Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

The vulnerability description indicates affected devices allow password changes but insufficiently validate which password is being changed, enabling an authenticated attacker to potentially change an administrator's password. The CVSS 3.1 score of 6.5 (Medium) reflects network attack vector, low attack complexity, low privileges required, no user interaction, and high impact to integrity. The CISA advisory ICSA-24-165-12 was published on 2024-06-11 and last modified on 2025-01-14 to add fixes for related CVEs and CVSSv4 vectors.

Official resources