Detections
Analytics
Siemens SCALANCE and RUGGEDCOM Use After Free (CVE-2023-42363)
medium Tenable OT Security Plugin ID 505129
Synopsis
The remote OT asset is affected by a vulnerability.Description
A use-after-free vulnerability was discovered in xasprintf function in xfuncs_printf.c:344 in BusyBox v.1.36.1.This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.
Solution
Refer to the vendor advisory.See Also
https://cert-portal.siemens.com/productcert/html/ssa-089022.html
https://support.industry.siemens.com/cs/ww/en/view/109997626/
https://www.cisa.gov/news-events/ics-advisories/icsa-26-043-06
Plugin Details
Severity: Medium
ID: 505129
File Name: tenable_ot_siemens_CVE-2023-42363.nasl
Version: 1.3
Type: remote
Family: Tenable.ot
Published: 2/10/2026
Updated: 3/5/2026
Supported Sensors: Tenable OT Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 4.9
Temporal Score: 3.8
Vector: CVSS2#AV:L/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2023-42363
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 5
Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:siemens:scalance_xrm334_%28230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_8xfo%29_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_8xfo%29_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_8xfo%29_firmware:3.3, cpe:/o:siemens:scalance_xr-500wg_series_firmware, cpe:/o:siemens:scalance_xrm334_%282x230_v_ac%2c_12xfo%29_firmware:3.3, cpe:/o:siemens:scalance_xch328_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%2824v_dc%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3, cpe:/o:siemens:scalance_xc-300_series_firmware, cpe:/o:siemens:scalance_xc-400_series_firmware, cpe:/o:siemens:scalance_xcm328_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%28230_v_ac%2c_12xfo%29_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%282x230v_ac%2c_2x10g%2c_24xsfp%2c_8xsfp%2b%29_firmware:3.3, cpe:/o:siemens:ruggedcom_rst2428p_firmware:3.3, cpe:/o:siemens:scalance_xr-300_series_firmware, cpe:/o:siemens:scalance_xcm324_firmware:3.3, cpe:/o:siemens:scalance_xrm334_%2824_v_dc%2c_12xfo%29_firmware:3.3, cpe:/o:siemens:scalance_xr-500_series_firmware, cpe:/o:siemens:scalance_xrh334_%2824_v_dc%2c_8xfo%2c_cc%29_firmware:3.3, cpe:/o:siemens:scalance_xcm332_firmware
Required KB Items: Tenable.ot/Siemens
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 1/28/2026
Vulnerability Publication Date: 11/27/2023
Reference Information
CVE: CVE-2023-42363
CWE: 416
ICSA: 26-043-06