CVE-2023-44318Network attack vector

Configuration disclosure via hardcoded backup obfuscation key

Published Nov 14, 2023 · Updated Feb 25, 2026

Information disclosure in Siemens SCALANCE and RUGGEDCOM devices allows attackers to extract configuration data from exported backups. The backup exporter obfuscates device configuration with a hardcoded key, allowing anyone who obtains the file to reverse the protection and recover its contents. Generating the backup requires an authenticated administrator, but possession of an already exported file is sufficient for offline extraction.

CVSS severity4.9

Medium

EPSS probability0.69%

Next 30 days · Sep 16, 2026

Known exploitationUnconfirmed

Based on sourced intelligence

Hinoki checkNot available

Coverage for this vulnerability

See if you're affected

Explore vulnerability checks for your environment with Hinoki.

Book a demo

Summary

What happened

The record

CVE: CVE-2023-44318
Published: Nov 14, 2023
Updated: Feb 25, 2026

Vendor: Siemens
Product: SCALANCE XC208G (EIP def.)
Classifications: CWE-321, T1552.001

Attack vector: network
Privileges: admin

Timeline

How it unfolded

Nov 14, 2023CVE publishedPublication date reported by the CVE source.
Feb 25, 2026Record updatedLatest update available in the CVE record.

Exploitability

Present is not the same as exploitable

Compare your product and version with the public record. A matching version still requires validation against your environment.

Is a vulnerable build present?

Compare these published version ranges with your installed build and any vendor patches.

Affected versionversion=0 <*

What conditions does exploitation require?

Attack vectornetwork

Required privilegesadmin

What is affected?

Siemens · SCALANCE XC208G (EIP def.)version=0 <*

Siemens · SCALANCE XB213-3LD (SC, E/IP)version=0 <*

Siemens · SCALANCE XC208G PoEversion=0 <*

Siemens · SCALANCE XC208Gversion=0 <*

Siemens · SCALANCE MUM856-1 (RoW)version=0 <*

Siemens · SCALANCE XR324WGversion=0 <*

Siemens · SCALANCE XC206-2 (ST/BFOC)version=0 <*

Siemens · SCALANCE XR328-4C WGversion=0 <*

Siemens · SCALANCE XC206-2SFP G (EIP DEF.)version=0 <*

Siemens · SCALANCE XP208EECversion=0 <*

Siemens · SCALANCE XC206-2SFP Gversion=0 <*

Siemens · SCALANCE XP216Gversion=0 <*

Siemens · SCALANCE MUM856-1 (EU)version=0 <*

Siemens · SIPLUS NET SCALANCE XC208version=0 <*

Siemens · SCALANCE XF204Gversion=0 <*

Siemens · SCALANCE XC216-4C G (EIP Def.)version=0 <*

Siemens · SCALANCE XB205-3 (ST, PN)version=0 <*

Siemens · SCALANCE XP216 (Ethernet/IP)version=0 <*

Siemens · SCALANCE XC224-4C G (EIP Def.)version=0 <*

Siemens · SCALANCE XR328-4C WG (28xGE, DC 24V)version=0 <*

Siemens · SCALANCE XB213-3LD (SC, PN)version=0 <*

Siemens · RUGGEDCOM RM1224 LTE(4G) NAMversion=0 <*

Siemens · RUGGEDCOM RM1224 LTE(4G) EUversion=0 <*

Siemens · SCALANCE XC208G EECversion=0 <*

Siemens · SCALANCE XF204-2BAversion=0 <*

Siemens · SCALANCE XP216version=0 <*

Siemens · SCALANCE M874-3version=0 <*

Siemens · SCALANCE XC216-4Cversion=0 <*

Siemens · SCALANCE XP208G PPversion=0 <*

Siemens · SCALANCE XB206-2LDversion=0 <*

Siemens · SCALANCE XC206-2SFPversion=0 <*

Siemens · SCALANCE XF204 DNAversion=0 <*

Siemens · SCALANCE XC216version=0 <*

Siemens · SCALANCE XC206-2SFP G EECversion=0 <*

Siemens · SCALANCE XB205-3 (ST, E/IP)version=0 <*

Siemens · SCALANCE XP208G EECversion=0 <*

Siemens · SCALANCE XC216EECversion=0 <*

Siemens · SCALANCE XC216-4C Gversion=0 <*

Siemens · SCALANCE XB213-3 (SC, PN)version=0 <*

Siemens · SCALANCE XB205-3LD (SC, E/IP)version=0 <*

Siemens · SCALANCE M812-1 ADSL Routerversion=0 <*

Siemens · SIPLUS NET SCALANCE XC206-2version=0 <*

Siemens · SCALANCE XC216-3G PoEversion=0 <*

Siemens · SCALANCE S615 EEC LAN Routerversion=0 <*

Siemens · SCALANCE XC206-2 (SC)version=0 <*

Siemens · SCALANCE XC208EECversion=0 <*

Siemens · SCALANCE XP208version=0 <*

Siemens · SCALANCE M826-2 SHDSL-Routerversion=0 <*

Siemens · SCALANCE M816-1 ADSL Routerversion=0 <*

Siemens · SCALANCE M876-3 (ROK)version=0 <*

Siemens · SCALANCE XP208 (Ethernet/IP)version=0 <*

Siemens · SCALANCE M876-3version=0 <*

Siemens · SCALANCE XC206-2G PoE (54 V DC)version=0 <*

Siemens · SIPLUS NET SCALANCE XC216-4Cversion=0 <*

Siemens · SCALANCE XC216-4C G EECversion=0 <*

Siemens · SCALANCE XB205-3 (SC, PN)version=0 <*

Siemens · SCALANCE XB206-2 SCversion=0 <*

Siemens · SCALANCE XB206-2 (ST/BFOC)version=0 <*

Siemens · SCALANCE XC224-4C Gversion=0 <*

Siemens · SCALANCE XB216 (PN)version=0 <*

Siemens · SCALANCE XP208PoE EECversion=0 <*

Siemens · SCALANCE XP208G PoE EECversion=0 <*

Siemens · SCALANCE XB208 (E/IP)version=0 <*

Siemens · SCALANCE XP216G PoE EECversion=0 <*

Siemens · SCALANCE M804PBversion=0 <*

Siemens · SCALANCE XB206-2 LDversion=0 <*

Siemens · SCALANCE XF204version=0 <*

Siemens · SCALANCE XR326-2C PoE WGversion=0 <*

Siemens · SCALANCE XC208version=0 <*

Siemens · SCALANCE XB206-2 STversion=0 <*

Siemens · SCALANCE XC224version=0 <*

Siemens · SCALANCE XC224-4C G EECversion=0 <*

Siemens · SCALANCE M876-4version=0 <*

Siemens · SCALANCE XP216POE EECversion=0 <*

Siemens · SCALANCE XF204-2BA DNAversion=0 <*

Siemens · SCALANCE XC206-2SFP EECversion=0 <*

Siemens · SCALANCE XP216EECversion=0 <*

Siemens · SCALANCE M876-4 (NAM)version=0 <*

Siemens · SCALANCE MUM853-1 (EU)version=0 <*

Siemens · SCALANCE XC206-2G PoEversion=0 <*

Siemens · SCALANCE XB208 (PN)version=0 <*

Siemens · SCALANCE XB213-3 (SC, E/IP)version=0 <*

Siemens · SCALANCE XB216 (E/IP)version=0 <*

Siemens · SCALANCE XC208G PoE (54 V DC)version=0 <*

Siemens · SCALANCE XP208Gversion=0 <*

Siemens · SCALANCE XB205-3LD (SC, PN)version=0 <*

Siemens · SIPLUS NET SCALANCE XC206-2SFPversion=0 <*

Siemens · SCALANCE XP216G EECversion=0 <*

Siemens · SCALANCE XB213-3 (ST, PN)version=0 <*

Siemens · SCALANCE S615 LAN-Routerversion=0 <*

Siemens · SCALANCE M876-4 (EU)version=0 <*

Siemens · SCALANCE XB213-3 (ST, E/IP)version=0 <*

Siemens · SCALANCE XC216-3G PoE (54 V DC)version=0 <*

Siemens · SCALANCE XC206-2G PoE EEC (54 V DC)version=0 <*

Siemens · SCALANCE M874-2version=0 <*

Published CVSS scores

4.9Siemens ProductCERTCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

6.9Siemens ProductCERTCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS describes severity. EPSS estimates exploitation probability.

Attacks

What attackers are doing with it

Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.

Daily unique IPsNo honeypot observations are available for this CVE in the selected window.

No observations available

Sep 10, 2026Sep 16, 2026

Latest reporting daySep 16, 2026

Latest daily unique IPsUnavailable

Prior 30-day averageUnavailable

SourceShadowserver honeypots (KEV)

Vectornetwork

Privilegesadmin

Known exploitationUnconfirmed

Public exploitUnconfirmed

Weakness, pattern, technique

CWE-321Use of Hard-coded Cryptographic Key

T1552.001Credentials In Files

Public exploit references

No public exploit references are available in this record.

Labels summarize the accepted research assessment. They do not indicate a test against your environment.

Technologies

Your stack

See the directory against your own environment.

Your stack

Check the software in your environment

Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.

Book a demo