Authentication bypass by spoofing in Siemens SCALANCE W721-1 RJ45
Key facts
- Attack vector
- Adjacent network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-290.
Summary
A vulnerability has been identified in SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AA0) (All versions), SCALANCE W721-1 RJ45 (6GK5721-1FC00-0AB0) (All versions), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AA0) (All versions), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AB0) (All versions), SCALANCE W722-1 RJ45 (6GK5722-1FC00-0AC0) (All versions), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA0) (All versions), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AA6) (All versions), SCALANCE W734-1 RJ45 (6GK5734-1FX00-0AB0) (All versions), SCALANCE W734-1 RJ45 (USA) (6GK5734-1FX00-0AB6) (All versions), SCALANCE W738-1 M12 (6GK5738-1GY00-0AA0) (All versions), SCALANCE W738-1 M12 (6GK5738-1GY00-0AB0) (All versions), SCALANCE W748-1 M12 (6GK5748-1GD00-0AA0) (All versions), SCALANCE W748-1 M12 (6GK5748-1GD00-0AB0) (All versions), SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AA0) (All versions), SCALANCE W748-1 RJ45 (6GK5748-1FC00-0AB0) (All versions), SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AA0) (All versions), SCALANCE W761-1 RJ45 (6GK5761-1FC00-0AB0) (All versions), SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TA0) (All versions), SCALANCE W774-1 M12 EEC (6GK5774-1FY00-0TB0) (All versions), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA0) (All versions), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AA6) (All versions), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AB0) (All versions), SCALANCE W774-1 RJ45 (6GK5774-1FX00-0AC0) (All versions), SCALANCE W774-1 RJ45 (USA) (6GK5774-1FX00-0AB6) (All versions), SCALANCE W778-1 M12 (6GK5778-1GY00-0AA0) (All versions), SCALANCE W778-1 M12 (6GK5778-1GY00-0AB0) (All versions), SCALANCE W778-1 M12 EEC (6GK5778-1GY00-0TA0) (All versions), SCALANCE W778-1 M12 EEC (USA) (6GK5778-1GY00-0TB0) (All versions), SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AA0) (All versions), SCALANCE W786-1 RJ45 (6GK5786-1FC00-0AB0) (All versions), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AA0) (All versions), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AB0) (All versions), SCALANCE W786-2 RJ45 (6GK5786-2FC00-0AC0) (All versions), SCALANCE W786-2 SFP (6GK5786-2FE00-0AA0) (All versions), SCALANCE W786-2 SFP (6GK5786-2FE00-0AB0) (All versions), SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AA0) (All versions), SCALANCE W786-2IA RJ45 (6GK5786-2HC00-0AB0) (All versions), SCALANCE W788-1 M12 (6GK5788-1GD00-0AA0) (All versions), SCALANCE W788-1 M12 (6GK5788-1GD00-0AB0) (All versions), SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AA0) (All versions), SCALANCE W788-1 RJ45 (6GK5788-1FC00-0AB0) (All versions), SCALANCE W788-2 M12 (6GK5788-2GD00-0AA0) (All versions), SCALANCE W788-2 M12 (6GK5788-2GD00-0AB0) (All versions), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TA0) (All versions), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TB0) (All versions), SCALANCE W788-2 M12 EEC (6GK5788-2GD00-0TC0) (All versions), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AA0) (All versions), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AB0) (All versions), SCALANCE W788-2 RJ45 (6GK5788-2FC00-0AC0) (All versions). This CVE refers to Scenario 1 "Leak frames from the Wi-Fi queue" of CVE-2022-47522. Affected devices queue frames in order to subsequently change the security context and leak the queued frames. This could allow a physically proximate attacker to intercept (possibly cleartext) target-destined frames.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Siemens | SCALANCE W721-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W721-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W722-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W722-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W722-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W734-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W734-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W734-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W734-1 RJ45 (USA) | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W738-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W738-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W748-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W748-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W748-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W748-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W761-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W761-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 M12 EEC | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 M12 EEC | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W774-1 RJ45 (USA) | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W778-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W778-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W778-1 M12 EEC | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W778-1 M12 EEC (USA) | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2 SFP | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2 SFP | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2IA RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W786-2IA RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-1 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-1 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 M12 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 M12 EEC | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 M12 EEC | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 M12 EEC | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 RJ45 | all versions | — | No fix listed | CNA |
| Siemens | SCALANCE W788-2 RJ45 | all versions | — | No fix listed | CNA |
- SCALANCE W721-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W721-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W722-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W722-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W722-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W734-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W734-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W734-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W734-1 RJ45 (USA) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W738-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W738-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W748-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W748-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W748-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W748-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W761-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W761-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 M12 EEC VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 M12 EEC VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W774-1 RJ45 (USA) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W778-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W778-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W778-1 M12 EEC VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W778-1 M12 EEC (USA) VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2 SFP VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2 SFP VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2IA RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W786-2IA RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-1 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-1 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 M12 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 M12 EEC VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 M12 EEC VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 M12 EEC VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
- SCALANCE W788-2 RJ45 VendorSiemens Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2024-30189
- 2026-10-03 Alias added: GHSA-6qcj-8j88-4gxg
References
More Siemens vulnerabilities
- TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
- TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
- TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
Sources
- CVE-2024-30189 · CVE Program
- CVE-2024-30189 · NVD
- FIRST EPSS
- GHSA-6qcj-8j88-4gxg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences