CVE-2025-24499

HIGH7.5

Description

A vulnerability has been identified in SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices do not properly validate input while loading the configuration files. This could allow an authenticated remote attacker to execute arbitrary shell commands on the device.

CVSS breakdown

CVSS 4.0

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

High

User Interaction

None

Confidentiality (Vulnerable System)

High

Integrity (Vulnerable System)

High

Availability (Vulnerable System)

High

Confidentiality (Subsequent System)

None

Integrity (Subsequent System)

None

Availability (Subsequent System)

None

CVSS 3.1

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Physical

Changed

Affected products

Siemens / SCALANCE WAB762-10 – V3.0.0
Siemens / SCALANCE WAM763-10 – V3.0.0
Siemens / SCALANCE WAM763-1 (ME)0 – V3.0.0
Siemens / SCALANCE WAM763-1 (US)0 – V3.0.0
Siemens / SCALANCE WAM766-10 – V3.0.0
Siemens / SCALANCE WAM766-1 EEC0 – V3.0.0
Siemens / SCALANCE WAM766-1 EEC (ME)0 – V3.0.0
Siemens / SCALANCE WAM766-1 EEC (US)0 – V3.0.0
Siemens / SCALANCE WAM766-1 (ME)0 – V3.0.0
Siemens / SCALANCE WAM766-1 (US)0 – V3.0.0
Siemens / SCALANCE WUB762-10 – V3.0.0
Siemens / SCALANCE WUB762-1 iFeatures0 – V3.0.0
Siemens / SCALANCE WUM763-10 – V3.0.0
Siemens / SCALANCE WUM763-1 (US)0 – V3.0.0
Siemens / SCALANCE WUM766-10 – V3.0.0
Siemens / SCALANCE WUM766-1 (ME)0 – V3.0.0
Siemens / SCALANCE WUM766-1 (USA)0 – V3.0.0

References

MISChttps://cert-portal.siemens.com/productcert/html/ssa-769027.html