Security Resilience

CVE-2023-44319

Crypto Weakness in Siemens 6Gk5205-3Bb00-2Ab2 Firmware ≤ 4.5

Crypto Weakness
Published
14 November 2023
Modified
14 January 2025
Patch / advisory
View advisory
CVSS Score v4 6.9
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0045 37th percentile
Risk Priority 28 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-44319 is a medium-severity Use of Weak Hash (CWE-328) vulnerability in Siemens 6Gk5205-3Bb00-2Ab2 Firmware. Its CVSS base score is 6.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.0), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.0), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V8.0), SCALANCE…

more

M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V8.0), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V8.0), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.0), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.0), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.0), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.0), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.0), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.0), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.0), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.0), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.0), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.0), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.0), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.0), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.0), SCALANCE WAB762-1 (6GK5762-1AJ00-6AA0) (All versions < V3.0.0), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions < V3.0.0), SCALANCE WAM763-1 (ME) (6GK5763-1AL00-7DC0) (All versions < V3.0.0), SCALANCE WAM763-1 (US) (6GK5763-1AL00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions < V3.0.0), SCALANCE WAM766-1 (ME) (6GK5766-1GE00-7DC0) (All versions < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (ME) (6GK5766-1GE00-7TC0) (All versions < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions < V3.0.0), SCALANCE WUB762-1 (6GK5762-1AJ00-1AA0) (All versions < V3.0.0), SCALANCE WUB762-1 iFeatures (6GK5762-1AJ00-2AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3AB0) (All versions < V3.0.0), SCALANCE WUM763-1 (US) (6GK5763-1AL00-3DB0) (All versions < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions < V3.0.0), SCALANCE WUM766-1 (ME) (6GK5766-1GE00-3DC0) (All versions < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions < V3.0.0). Affected devices use a weak checksum algorithm to protect the configuration backup that an administrator can export from the device. This could allow an authenticated attacker with administrative privileges or an attacker that tricks a legitimate administrator to upload a modified configuration file to change the configuration of an affected device.

CWE(s)
CWE-328

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
attack.mitre.org →
T1003.004 LSA Secrets Credential Access
Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.
attack.mitre.org →
T1014 Rootkit Stealth
Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.
attack.mitre.org →
T1016.002 Wi-Fi Discovery Discovery
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
attack.mitre.org →
T1021.007 Cloud Services Lateral Movement
Adversaries may log into accessible cloud services within a compromised environment using [Valid Accounts](https://attack.
attack.mitre.org →
T1021.008 Direct Cloud VM Connections Lateral Movement
Adversaries may leverage [Valid Accounts](https://attack.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-44374Same product: Siemens 6Ag1206-2Bb00-7Ac2
CVE-2023-44318Same product: Siemens 6Ag1206-2Bb00-7Ac2
CVE-2023-44320Same product: Siemens 6Ag1206-2Bb00-7Ac2
CVE-2023-44322Same product: Siemens 6Ag1206-2Bb00-7Ac2
CVE-2023-44321Same product: Siemens 6Ag1206-2Bb00-7Ac2
CVE-2023-44373Same product: Siemens 6Ag1206-2Bb00-7Ac2
CVE-2026-36182Shared CWE-328
CVE-2026-27754Shared CWE-328
CVE-2026-44582Shared CWE-328
CVE-2025-59354Shared CWE-328

Affected Assets

siemens
6gk5205-3bb00-2ab2 firmware
≤ 4.5
siemens
6gk5205-3bb00-2tb2 firmware
≤ 4.5
siemens
6gk5205-3bd00-2tb2 firmware
≤ 4.5
siemens
6gk5205-3bd00-2ab2 firmware
≤ 4.5
siemens
6gk5205-3bf00-2tb2 firmware
≤ 4.5
siemens
6gk5205-3bf00-2ab2 firmware
≤ 4.5
siemens
6gk5208-0ba00-2tb2 firmware
≤ 4.5
siemens
6gk5208-0ba00-2ab2 firmware
≤ 4.5
siemens
6gk5213-3bd00-2tb2 firmware
≤ 4.5
siemens
6gk5213-3bd00-2ab2 firmware
≤ 4.5
+61 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 3 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V11.2.3
  • V6.5.2

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-13 Cryptographic Protection
addresses: CWE-328

Requires appropriate hash functions for cryptographic uses, preventing reliance on weak hashes.

SI-2 Flaw Remediation
addresses: CWE-328

Security updates supplant weak hashing algorithms with stronger alternatives before attackers can exploit the original weakness.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 partial match
blocks

Proper data-at-rest integrity protection requires strong cryptographic hashes, directly blocking weak-hash usage.

PR.DS-02 partial match
blocks

Data-in-transit integrity likewise depends on strong hashes, so the control prevents the weakness while the weakness only partially satisfies the outcome.

PR.PS-06 partial match
blocks

Secure-SDLC requirements explicitly forbid weak cryptographic algorithms, fully preventing CWE-328 while covering only one aspect of development practice.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.36 Compliance with policies, rules and standards for information security partial match
removes
A.8.19 Installation of software on operational systems partial match
removes
A.8.24 Use of cryptography partial match
prevents

A.8.24's policy, algorithm selection (b,f), and key management directly require strong hashes meeting security expectations, preventing weak-hash use in most approved cryptographic contexts, but leaves a bounded remainder for non-crypto uses of hashing (e.g. data structures, non-security checksums) where the clause has no mandate.

A.8.26 Application security requirements partial match
blocks

A.8.26 only requires that security requirements (including those that could call for strong hashing via 8.24) be identified during development or acquisition; it does not itself mandate, enforce or implement any specific algorithm or protection that stops a weak hash from being exploitable.

A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
prevents

Requires secure coding standards that forbid weak hash functions in source code.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (higher-evidence rows only; rows rated `none` are excluded).

Windows 10 (1 rule)
  • V-220937 The system must be configured to prevent the storage of the LAN Manager hash of passwords. blocks CWE-328
Windows Server 2016 (1 rule)
  • V-225053 Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords. blocks CWE-328
Windows Server 2019 (1 rule)
  • V-205654 Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords. blocks CWE-328

References