Multiple OpenSSL Vulnerabilities in SCALANCE W1750D Devices

An attacker could read sensitive data from device memory (including encryption keys and credentials), decrypt encrypted communications between control devices, or crash the access point to disrupt wireless network connectivity to critical equipment. Loss of wireless connectivity could interrupt remote monitoring or control operations.

Operators of Siemens SCALANCE W1750D wireless access points, commonly deployed as part of industrial wireless networks in manufacturing plants, refineries, and utilities. These devices are often used to extend network connectivity to field devices and remote PLC installations.

An attacker with network access to the SCALANCE W1750D (typically through the WiFi network or Ethernet management interface) could send specially crafted SSL/TLS handshake packets to trigger memory read or use-after-free conditions. No authentication is required. Successful exploitation could expose RSA private keys stored in device memory, allowing decryption of past communications, or crash the device to trigger a denial of service.