Siemens SCALANCE M-800 and SC-600 Families

An attacker could bypass OpenVPN authentication on affected SCALANCE routers, potentially gaining unauthorized access to network management functions or altering device configuration. The SCALANCE SC-600 family has no fix available and remains at risk.

Water utilities and electric utilities that use Siemens SCALANCE M-800 series routers (SCALANCE M826, M874, M876, MUB852, MUM853, MUM856 models) or RUGGEDCOM RM1224 LTE routers for remote site connectivity or network segmentation. The SCALANCE SC-600 family, commonly used in industrial networks, is affected but has no vendor fix available. These are critical network boundary devices—unauthorized access could allow an attacker to reconfigure network access policies or gain visibility into control system networks.

An attacker with network access to an affected SCALANCE router's OpenVPN service port could send specially crafted authentication messages that exploit improper input validation, bypassing the authentication check and gaining access to device management functions.