Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2022-29884 (GCVE-0-2022-29884)
Vulnerability from cvelistv5
- CWE-772 - Missing Release of Resource after Effective Lifetime
URL | Tags | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
|
Vendor | Product | Version | |||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Siemens | CP-8000 MASTER MODULE WITH I/O -25/+70°C |
Version: All versions < CPC80 V16.30 |
|||||||||||||||||
|
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-03T06:33:43.055Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c CPC80 V16.30" } ] }, { "product": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c CPC80 V16.30" } ] }, { "product": "CP-8021 MASTER MODULE", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c CPC80 V16.30" } ] }, { "product": "CP-8022 MASTER MODULE WITH GPRS", "vendor": "Siemens", "versions": [ { "status": "affected", "version": "All versions \u003c CPC80 V16.30" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition." } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-772", "description": "CWE-772: Missing Release of Resource after Effective Lifetime", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2022-07-12T10:06:40", "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens" }, "references": [ { "tags": [ "x_refsource_MISC" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-29884", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } }, { "product_name": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } }, { "product_name": "CP-8021 MASTER MODULE", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } }, { "product_name": "CP-8022 MASTER MODULE WITH GPRS", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-772: Missing Release of Resource after Effective Lifetime" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ] } } } }, "cveMetadata": { "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "assignerShortName": "siemens", "cveId": "CVE-2022-29884", "datePublished": "2022-07-12T10:06:40", "dateReserved": "2022-04-28T00:00:00", "dateUpdated": "2024-08-03T06:33:43.055Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2022-29884\",\"sourceIdentifier\":\"productcert@siemens.com\",\"published\":\"2022-07-12T10:15:10.547\",\"lastModified\":\"2024-11-21T06:59:54.170\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.\"},{\"lang\":\"es\",\"value\":\"Se ha identificado una vulnerabilidad en el MASTER MODULE CP-8000 CON E/S -25/+70\u00b0C (Todas las versiones anteriores a CPC80 V16.30), MASTER MODULE CP-8000 CON E/S -40/+70\u00b0C (Todas las versiones anteriores a CPC80 V16.30), MASTER MODULE CP-8021 (Todas las versiones anteriores a CPC80 V16.30), MASTER MODULE CP-8022 CON GPRS (Todas las versiones anteriores a CPC80 V16.30). Cuando es usado el servidor HTTPS en condiciones espec\u00edficas, los dispositivos afectados no liberan apropiadamente los recursos. Esto podr\u00eda permitir a un atacante remoto no autenticado poner el dispositivo en una condici\u00f3n de denegaci\u00f3n de servicio\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:N/A:C\",\"baseScore\":7.1,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":8.6,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"productcert@siemens.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-772\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-772\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:sicam_a8000_cp-8000_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.30\",\"matchCriteriaId\":\"6A3EDA09-C712-416E-BEE4-B49F867FEB56\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:sicam_a8000_cp-8000:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8DEF18ED-BF87-4CFA-A4BA-3387AC8964B3\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:sicam_a8000_cp-8021_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.30\",\"matchCriteriaId\":\"41F8797E-D4EC-4758-B526-35178F304DE1\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:sicam_a8000_cp-8021:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65362A2F-DB6D-4D7F-87B5-10E18EE990F0\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:siemens:sicam_a8000_cp-8022_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"16.30\",\"matchCriteriaId\":\"1182239D-D513-4C0F-8460-D4BDD6A2373A\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:siemens:sicam_a8000_cp-8022:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"64D59FE8-03FD-4E5B-B7D2-47F31E98A187\"}]}]}],\"references\":[{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf\",\"source\":\"productcert@siemens.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}" } }
fkie_cve-2022-29884
Vulnerability from fkie_nvd
URL | Tags | ||
---|---|---|---|
productcert@siemens.com | https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf | Patch, Vendor Advisory | |
af854a3a-2127-422b-91ae-364da2661108 | https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf | Patch, Vendor Advisory |
Vendor | Product | Version | |
---|---|---|---|
siemens | sicam_a8000_cp-8000_firmware | * | |
siemens | sicam_a8000_cp-8000 | - | |
siemens | sicam_a8000_cp-8021_firmware | * | |
siemens | sicam_a8000_cp-8021 | - | |
siemens | sicam_a8000_cp-8022_firmware | * | |
siemens | sicam_a8000_cp-8022 | - |
{ "configurations": [ { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:sicam_a8000_cp-8000_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A3EDA09-C712-416E-BEE4-B49F867FEB56", "versionEndExcluding": "16.30", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:sicam_a8000_cp-8000:-:*:*:*:*:*:*:*", "matchCriteriaId": "8DEF18ED-BF87-4CFA-A4BA-3387AC8964B3", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:sicam_a8000_cp-8021_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "41F8797E-D4EC-4758-B526-35178F304DE1", "versionEndExcluding": "16.30", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:sicam_a8000_cp-8021:-:*:*:*:*:*:*:*", "matchCriteriaId": "65362A2F-DB6D-4D7F-87B5-10E18EE990F0", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" }, { "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:siemens:sicam_a8000_cp-8022_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "1182239D-D513-4C0F-8460-D4BDD6A2373A", "versionEndExcluding": "16.30", "vulnerable": true } ], "negate": false, "operator": "OR" }, { "cpeMatch": [ { "criteria": "cpe:2.3:h:siemens:sicam_a8000_cp-8022:-:*:*:*:*:*:*:*", "matchCriteriaId": "64D59FE8-03FD-4E5B-B7D2-47F31E98A187", "vulnerable": false } ], "negate": false, "operator": "OR" } ], "operator": "AND" } ], "cveTags": [], "descriptions": [ { "lang": "en", "value": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition." }, { "lang": "es", "value": "Se ha identificado una vulnerabilidad en el MASTER MODULE CP-8000 CON E/S -25/+70\u00b0C (Todas las versiones anteriores a CPC80 V16.30), MASTER MODULE CP-8000 CON E/S -40/+70\u00b0C (Todas las versiones anteriores a CPC80 V16.30), MASTER MODULE CP-8021 (Todas las versiones anteriores a CPC80 V16.30), MASTER MODULE CP-8022 CON GPRS (Todas las versiones anteriores a CPC80 V16.30). Cuando es usado el servidor HTTPS en condiciones espec\u00edficas, los dispositivos afectados no liberan apropiadamente los recursos. Esto podr\u00eda permitir a un atacante remoto no autenticado poner el dispositivo en una condici\u00f3n de denegaci\u00f3n de servicio" } ], "id": "CVE-2022-29884", "lastModified": "2024-11-21T06:59:54.170", "metrics": { "cvssMetricV2": [ { "acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false } ], "cvssMetricV31": [ { "cvssData": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary" } ] }, "published": "2022-07-12T10:15:10.547", "references": [ { "source": "productcert@siemens.com", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" }, { "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [ { "description": [ { "lang": "en", "value": "CWE-772" } ], "source": "productcert@siemens.com", "type": "Secondary" }, { "description": [ { "lang": "en", "value": "CWE-772" } ], "source": "nvd@nist.gov", "type": "Primary" } ] }
var-202207-0711
Vulnerability from variot
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition. Siemens' SICAM A8000 CP-8000 firmware, SICAM A8000 CP-8021 firmware, SICAM A8000 CP-8022 A vulnerability exists in firmware for lack of freeing resources after valid lifetime.Service operation interruption (DoS) It may be in a state. The SICAM A8000 RTU (Remote Terminal Unit) series is a modular device family for remote control and automation applications in all areas of energy supply
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-202207-0711", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "sicam a8000 cp-8000", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "16.30" }, { "model": "sicam a8000 cp-8022", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "16.30" }, { "model": "sicam a8000 cp-8021", "scope": "lt", "trust": 1.0, "vendor": "siemens", "version": "16.30" }, { "model": "sicam a8000 cp-8022", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "sicam a8000 cp-8021", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "sicam a8000 cp-8000", "scope": null, "trust": 0.8, "vendor": "\u30b7\u30fc\u30e1\u30f3\u30b9", "version": null }, { "model": "cp-8000 master module with i/o -25/+70\u00b0c", "scope": "lt", "trust": 0.6, "vendor": "siemens", "version": "16.30" }, { "model": "cp-8000 master module with i/o -40/+70\u00b0c", "scope": "lt", "trust": 0.6, "vendor": "siemens", "version": "16.30" }, { "model": "cp-8021 master module", "scope": "lt", "trust": 0.6, "vendor": "siemens", "version": "16.30" }, { "model": "cp-8022 master module with gprs", "scope": "lt", "trust": 0.6, "vendor": "siemens", "version": "16.30" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "NVD", "id": "CVE-2022-29884" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Michael Messner from Siemens Energy reported this vulnerability to Siemens.", "sources": [ { "db": "CNNVD", "id": "CNNVD-202207-941" } ], "trust": 0.6 }, "cve": "CVE-2022-29884", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "COMPLETE", "baseScore": 7.1, "confidentialityImpact": "NONE", "exploitabilityScore": 8.6, "id": "CVE-2022-29884", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "HIGH", "trust": 1.9, "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "COMPLETE", "baseScore": 7.8, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "CNVD-2022-51638", "impactScore": 6.9, "integrityImpact": "NONE", "severity": "HIGH", "trust": 0.6, "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "id": "CVE-2022-29884", "impactScore": 3.6, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2022-29884", "impactScore": null, "integrityImpact": "None", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2022-29884", "trust": 1.0, "value": "HIGH" }, { "author": "NVD", "id": "CVE-2022-29884", "trust": 0.8, "value": "High" }, { "author": "CNVD", "id": "CNVD-2022-51638", "trust": 0.6, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-202207-941", "trust": 0.6, "value": "HIGH" }, { "author": "VULMON", "id": "CVE-2022-29884", "trust": 0.1, "value": "HIGH" } ] } ], "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "VULMON", "id": "CVE-2022-29884" }, { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "CNNVD", "id": "CNNVD-202207-941" }, { "db": "NVD", "id": "CVE-2022-29884" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition. Siemens\u0027 SICAM A8000 CP-8000 firmware, SICAM A8000 CP-8021 firmware, SICAM A8000 CP-8022 A vulnerability exists in firmware for lack of freeing resources after valid lifetime.Service operation interruption (DoS) It may be in a state. The SICAM A8000 RTU (Remote Terminal Unit) series is a modular device family for remote control and automation applications in all areas of energy supply", "sources": [ { "db": "NVD", "id": "CVE-2022-29884" }, { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "VULMON", "id": "CVE-2022-29884" } ], "trust": 2.25 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2022-29884", "trust": 3.9 }, { "db": "SIEMENS", "id": "SSA-491621", "trust": 3.1 }, { "db": "ICS CERT", "id": "ICSA-22-195-14", "trust": 1.5 }, { "db": "JVN", "id": "JVNVU97764115", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2022-013266", "trust": 0.8 }, { "db": "CNVD", "id": "CNVD-2022-51638", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2022071329", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202207-941", "trust": 0.6 }, { "db": "VULMON", "id": "CVE-2022-29884", "trust": 0.1 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "VULMON", "id": "CVE-2022-29884" }, { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "CNNVD", "id": "CNNVD-202207-941" }, { "db": "NVD", "id": "CVE-2022-29884" } ] }, "id": "VAR-202207-0711", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" } ], "trust": 1.3974026 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "Network device" ], "sub_category": null, "trust": 0.6 } ], "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" } ] }, "last_update_date": "2024-08-14T13:42:36.694000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Patch for Siemens SICAM A8000 CPC80 Exists Unknown Vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchInfo/show/339931" }, { "title": "Siemens SICAM A8000 CP-8000 Remediation of resource management error vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=200067" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "CNNVD", "id": "CNNVD-202207-941" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-772", "trust": 1.0 }, { "problemtype": "Lack of resource release after valid lifetime (CWE-772) [NVD evaluation ]", "trust": 0.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "NVD", "id": "CVE-2022-29884" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.5, "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" }, { "trust": 0.8, "url": "https://jvn.jp/vu/jvnvu97764115/" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2022-29884" }, { "trust": 0.8, "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-14" }, { "trust": 0.6, "url": "https://cert-portal.siemens.com/productcert/html/ssa-491621.html" }, { "trust": 0.6, "url": "https://cxsecurity.com/cveshow/cve-2022-29884/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2022071329" }, { "trust": 0.6, "url": "https://us-cert.cisa.gov/ics/advisories/icsa-22-195-14" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/772.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-195-14" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "VULMON", "id": "CVE-2022-29884" }, { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "CNNVD", "id": "CNNVD-202207-941" }, { "db": "NVD", "id": "CVE-2022-29884" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "CNVD", "id": "CNVD-2022-51638" }, { "db": "VULMON", "id": "CVE-2022-29884" }, { "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "db": "CNNVD", "id": "CNNVD-202207-941" }, { "db": "NVD", "id": "CVE-2022-29884" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-07-15T00:00:00", "db": "CNVD", "id": "CNVD-2022-51638" }, { "date": "2022-07-12T00:00:00", "db": "VULMON", "id": "CVE-2022-29884" }, { "date": "2023-09-06T00:00:00", "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "date": "2022-07-12T00:00:00", "db": "CNNVD", "id": "CNNVD-202207-941" }, { "date": "2022-07-12T10:15:10.547000", "db": "NVD", "id": "CVE-2022-29884" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2022-07-15T00:00:00", "db": "CNVD", "id": "CNVD-2022-51638" }, { "date": "2022-07-19T00:00:00", "db": "VULMON", "id": "CVE-2022-29884" }, { "date": "2023-09-06T08:23:00", "db": "JVNDB", "id": "JVNDB-2022-013266" }, { "date": "2022-07-20T00:00:00", "db": "CNNVD", "id": "CNNVD-202207-941" }, { "date": "2022-07-19T18:18:45.773000", "db": "NVD", "id": "CVE-2022-29884" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-202207-941" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Lack of Freeing Resources After Valid Lifetime Vulnerability in Multiple Siemens Products", "sources": [ { "db": "JVNDB", "id": "JVNDB-2022-013266" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "resource management error", "sources": [ { "db": "CNNVD", "id": "CNNVD-202207-941" } ], "trust": 0.6 } }
cnvd-2022-51638
Vulnerability from cnvd
用户可参考如下供应商提供的安全公告获得补丁信息: https://cert-portal.siemens.com/productcert/html/ssa-491621.html
Name | ['Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C (6MF2101-0AB10-0AA0) <16.30', 'Siemens CP-8000 MASTER MODULE WITH I/O -40/+70°C (6MF2101-1AB10-0AA0) <16.30', 'Siemens CP-8021 MASTER MODULE (6MF2802-1AA00) <16.30', 'Siemens CP-8022 MASTER MODULE WITH GPRS (6MF2802-2AA00) <16.30'] |
---|
{ "cves": { "cve": { "cveNumber": "CVE-2022-29884" } }, "description": "SICAM A8000 RTU\uff08\u8fdc\u7a0b\u7ec8\u7aef\u5355\u5143\uff09\u7cfb\u5217\u662f\u4e00\u4e2a\u6a21\u5757\u5316\u8bbe\u5907\u7cfb\u5217\uff0c\u9002\u7528\u4e8e\u6240\u6709\u80fd\u6e90\u4f9b\u5e94\u9886\u57df\u7684\u8fdc\u7a0b\u63a7\u5236\u548c\u81ea\u52a8\u5316\u5e94\u7528\u3002\n\nSiemens SICAM A8000 CPC80\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u7279\u5b9a\u6761\u4ef6\u4e0b\u4f7f\u7528HTTPS\u670d\u52a1\u5668\u65f6\uff0c\u53d7\u5f71\u54cd\u7684\u8bbe\u5907\u65e0\u6cd5\u6b63\u786e\u91ca\u653e\u8d44\u6e90\uff0c\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u8bbe\u5907\u7f6e\u4e8e\u62d2\u7edd\u670d\u52a1\u72b6\u6001\u3002", "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-491621.html", "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e", "number": "CNVD-2022-51638", "openTime": "2022-07-15", "patchDescription": "SICAM A8000 RTU\uff08\u8fdc\u7a0b\u7ec8\u7aef\u5355\u5143\uff09\u7cfb\u5217\u662f\u4e00\u4e2a\u6a21\u5757\u5316\u8bbe\u5907\u7cfb\u5217\uff0c\u9002\u7528\u4e8e\u6240\u6709\u80fd\u6e90\u4f9b\u5e94\u9886\u57df\u7684\u8fdc\u7a0b\u63a7\u5236\u548c\u81ea\u52a8\u5316\u5e94\u7528\u3002\r\n\r\nSiemens SICAM A8000 CPC80\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5728\u7279\u5b9a\u6761\u4ef6\u4e0b\u4f7f\u7528HTTPS\u670d\u52a1\u5668\u65f6\uff0c\u53d7\u5f71\u54cd\u7684\u8bbe\u5907\u65e0\u6cd5\u6b63\u786e\u91ca\u653e\u8d44\u6e90\uff0c\u672a\u7ecf\u8eab\u4efd\u9a8c\u8bc1\u7684\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u8bbe\u5907\u7f6e\u4e8e\u62d2\u7edd\u670d\u52a1\u72b6\u6001\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002", "patchName": "Siemens SICAM A8000 CPC80\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u7684\u8865\u4e01", "products": { "product": [ "Siemens CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (6MF2101-0AB10-0AA0) \u003c16.30", "Siemens CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (6MF2101-1AB10-0AA0) \u003c16.30", "Siemens CP-8021 MASTER MODULE (6MF2802-1AA00) \u003c16.30", "Siemens CP-8022 MASTER MODULE WITH GPRS (6MF2802-2AA00) \u003c16.30" ] }, "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-491621.html", "serverity": "\u9ad8", "submitTime": "2022-07-15", "title": "Siemens SICAM A8000 CPC80\u5b58\u5728\u672a\u660e\u6f0f\u6d1e" }
gsd-2022-29884
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2022-29884", "description": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.", "id": "GSD-2022-29884" }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2022-29884" ], "details": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.", "id": "GSD-2022-29884", "modified": "2023-12-13T01:19:41.793717Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-29884", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } }, { "product_name": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } }, { "product_name": "CP-8021 MASTER MODULE", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } }, { "product_name": "CP-8022 MASTER MODULE WITH GPRS", "version": { "version_data": [ { "version_value": "All versions \u003c CPC80 V16.30" } ] } } ] }, "vendor_name": "Siemens" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "CWE-772: Missing Release of Resource after Effective Lifetime" } ] } ] }, "references": { "reference_data": [ { "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf", "refsource": "MISC", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ] } }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:sicam_a8000_cp-8000_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "16.30", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:sicam_a8000_cp-8000:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:sicam_a8000_cp-8021_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "16.30", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:sicam_a8000_cp-8021:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:siemens:sicam_a8000_cp-8022_firmware:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "16.30", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:siemens:sicam_a8000_cp-8022:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "productcert@siemens.com", "ID": "CVE-2022-29884" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-772" } ] } ] }, "references": { "reference_data": [ { "name": "N/A", "refsource": "CONFIRM", "tags": [ "Patch", "Vendor Advisory" ], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 7.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:C", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 3.6 } }, "lastModifiedDate": "2022-07-19T18:18Z", "publishedDate": "2022-07-12T10:15Z" } } }
icsa-22-195-14
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting this vulnerability to CISA." }, { "names": [ "Michael Messner" ], "organization": "Siemens Energy", "summary": "reporting the vulnerability" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "notes": [ { "category": "summary", "text": "A vulnerability was identified in the CPC80 firmware of SICAM A8000 devices. It could allow an unauthenticated remote attacker to cause a permanent denial of service condition.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.", "title": "Summary" }, { "category": "general", "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\n\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \n\nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-491621.json" }, { "category": "self", "summary": "SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-491621.txt" }, { "category": "self", "summary": "SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" }, { "category": "self", "summary": "ICS Advisory ICSA-22-195-14 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-195-14.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-195-14 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-14" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens CPC80 Firmware of SICAM A8000", "tracking": { "current_release_date": "2022-07-12T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-195-14", "initial_release_date": "2022-07-12T00:00:00.000000Z", "revision_history": [ { "date": "2022-07-12T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C", "product_id": "CSAFPID-0001", "product_identification_helper": { "model_numbers": [ "6MF2101-0AB10-0AA0" ] } } } ], "category": "product_name", "name": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C" }, { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C", "product_id": "CSAFPID-0002", "product_identification_helper": { "model_numbers": [ "6MF2101-1AB10-0AA0" ] } } } ], "category": "product_name", "name": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C" }, { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8021 MASTER MODULE", "product_id": "CSAFPID-0003", "product_identification_helper": { "model_numbers": [ "6MF2802-1AA00" ] } } } ], "category": "product_name", "name": "CP-8021 MASTER MODULE" }, { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8022 MASTER MODULE WITH GPRS", "product_id": "CSAFPID-0004", "product_identification_helper": { "model_numbers": [ "6MF2802-2AA00" ] } } } ], "category": "product_name", "name": "CP-8022 MASTER MODULE WITH GPRS" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29884", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "summary", "text": "When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to CPC80 V16.30 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109811278/" }, { "category": "workaround", "details": "Limit access to port 443/tcp to trusted IP addresses", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ] } ], "title": "CVE-2022-29884" } ] }
ICSA-22-195-14
Vulnerability from csaf_cisa
Notes
{ "document": { "acknowledgments": [ { "organization": "Siemens ProductCERT", "summary": "reporting this vulnerability to CISA." }, { "names": [ "Michael Messner" ], "organization": "Siemens Energy", "summary": "reporting the vulnerability" } ], "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Disclosure is not limited", "tlp": { "label": "WHITE", "url": "https://us-cert.cisa.gov/tlp/" } }, "notes": [ { "category": "summary", "text": "A vulnerability was identified in the CPC80 firmware of SICAM A8000 devices. It could allow an unauthenticated remote attacker to cause a permanent denial of service condition.\n\nSiemens has released updates for the affected products and recommends to update to the latest versions.", "title": "Summary" }, { "category": "general", "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\n\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \n\nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity", "title": "General Recommendations" }, { "category": "general", "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories", "title": "Additional Resources" }, { "category": "legal_disclaimer", "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.", "title": "Terms of Use" }, { "category": "legal_disclaimer", "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.", "title": "Legal Notice" }, { "category": "other", "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.", "title": "Advisory Conversion Disclaimer" }, { "category": "other", "text": "Multiple", "title": "Critical infrastructure sectors" }, { "category": "other", "text": "Worldwide", "title": "Countries/areas deployed" }, { "category": "other", "text": "Germany", "title": "Company headquarters location" }, { "category": "general", "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.", "title": "Recommended Practices" }, { "category": "general", "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.", "title": "Recommended Practices" }, { "category": "general", "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.", "title": "Recommended Practices" }, { "category": "general", "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.", "title": "Recommended Practices" }, { "category": "general", "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.", "title": "Recommended Practices" } ], "publisher": { "category": "other", "contact_details": "central@cisa.dhs.gov", "name": "CISA", "namespace": "https://www.cisa.gov/" }, "references": [ { "category": "self", "summary": "SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices - CSAF Version", "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-491621.json" }, { "category": "self", "summary": "SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices - TXT Version", "url": "https://cert-portal.siemens.com/productcert/txt/ssa-491621.txt" }, { "category": "self", "summary": "SSA-491621: Denial of Service Vulnerability in CPC80 Firmware of SICAM A8000 Devices - PDF Version", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" }, { "category": "self", "summary": "ICS Advisory ICSA-22-195-14 JSON", "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-195-14.json" }, { "category": "self", "summary": "ICS Advisory ICSA-22-195-14 - Web Version", "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-195-14" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/topics/industrial-control-systems" }, { "category": "external", "summary": "Recommended Practices", "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf" }, { "category": "external", "summary": "Recommended Practices", "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B" } ], "title": "Siemens CPC80 Firmware of SICAM A8000", "tracking": { "current_release_date": "2022-07-12T00:00:00.000000Z", "generator": { "engine": { "name": "CISA CSAF Generator", "version": "1.0.0" } }, "id": "ICSA-22-195-14", "initial_release_date": "2022-07-12T00:00:00.000000Z", "revision_history": [ { "date": "2022-07-12T00:00:00.000000Z", "legacy_version": "1.0", "number": "1", "summary": "Publication Date" } ], "status": "final", "version": "1" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C", "product_id": "CSAFPID-0001", "product_identification_helper": { "model_numbers": [ "6MF2101-0AB10-0AA0" ] } } } ], "category": "product_name", "name": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C" }, { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C", "product_id": "CSAFPID-0002", "product_identification_helper": { "model_numbers": [ "6MF2101-1AB10-0AA0" ] } } } ], "category": "product_name", "name": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C" }, { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8021 MASTER MODULE", "product_id": "CSAFPID-0003", "product_identification_helper": { "model_numbers": [ "6MF2802-1AA00" ] } } } ], "category": "product_name", "name": "CP-8021 MASTER MODULE" }, { "branches": [ { "category": "product_version_range", "name": "\u003cCPC80_V16.30", "product": { "name": "CP-8022 MASTER MODULE WITH GPRS", "product_id": "CSAFPID-0004", "product_identification_helper": { "model_numbers": [ "6MF2802-2AA00" ] } } } ], "category": "product_name", "name": "CP-8022 MASTER MODULE WITH GPRS" } ], "category": "vendor", "name": "Siemens" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-29884", "cwe": { "id": "CWE-772", "name": "Missing Release of Resource after Effective Lifetime" }, "notes": [ { "category": "summary", "text": "When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.", "title": "Summary" } ], "product_status": { "known_affected": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ] }, "remediations": [ { "category": "vendor_fix", "details": "Update to CPC80 V16.30 or later version", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ], "url": "https://support.industry.siemens.com/cs/ww/en/view/109811278/" }, { "category": "workaround", "details": "Limit access to port 443/tcp to trusted IP addresses", "product_ids": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ] } ], "scores": [ { "cvss_v3": { "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C", "version": "3.1" }, "products": [ "CSAFPID-0001", "CSAFPID-0002", "CSAFPID-0003", "CSAFPID-0004" ] } ], "title": "CVE-2022-29884" } ] }
ghsa-fc38-5jq6-2248
Vulnerability from github
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.
{ "affected": [], "aliases": [ "CVE-2022-29884" ], "database_specific": { "cwe_ids": [ "CWE-772" ], "github_reviewed": false, "github_reviewed_at": null, "nvd_published_at": "2022-07-12T10:15:00Z", "severity": "HIGH" }, "details": "A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.", "id": "GHSA-fc38-5jq6-2248", "modified": "2022-07-20T00:00:18Z", "published": "2022-07-13T00:01:56Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29884" }, { "type": "WEB", "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ] }
CERTFR-2022-AVI-627
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Siemens. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et un contournement de la politique de sécurité.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneVendor | Product | Description | ||
---|---|---|---|---|
Siemens | N/A | Mendix Applications using Mendix versions 9 (9.12) antérieures à 9.12.2 | ||
Siemens | N/A | Teamcenter Visualization V12.4 toutes versions | ||
Siemens | N/A | SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) versions antérieures à 3.0.22 | ||
Siemens | N/A | EN100 Ethernet module IEC 104 variant toutes versions | ||
Siemens | N/A | SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) versions antérieures à 2.0 | ||
Siemens | N/A | SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) toutes versions | ||
Siemens | N/A | SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) versions antérieures à 2.0 | ||
Siemens | N/A | SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) versions antérieures à 3.0.22 | ||
Siemens | N/A | SICAM GridEdge Essential ARM (6MD7881-2AA30) toutes versions | ||
Siemens | N/A | Mendix Applications using Mendix versions 8 antérieures à 8.18.18 | ||
Siemens | N/A | EN100 Ethernet module Modbus TCP variant toutes versions | ||
Siemens | N/A | SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) à SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) toutes versions | ||
Siemens | N/A | Teamcenter Visualization toutes versions 14.0.x | ||
Siemens | N/A | RUGGEDCOM ROX MX5000 à RX5000 versions antérieures à 2.15.1 | ||
Siemens | N/A | Mendix Excel Importer Module (Mendix 8 compatible) versions antérieures à 9.2.2 | ||
Siemens | N/A | SIMATIC MV540 H (6GF3540-0GE10) versions antérieures à 3.3 | ||
Siemens | N/A | SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) versions antérieures à 2.0 | ||
Siemens | N/A | Opcenter Quality versions 13.2 antérieures à 13.2.20220624 | ||
Siemens | N/A | SIMATIC MV540 S (6GF3540-0CD10) versions antérieures à 3.3 | ||
Siemens | N/A | Teamcenter Visualization versions 13.3.x antérieures à 13.3.0.5 | ||
Siemens | N/A | RUGGEDCOM ROS toutes versions : Se référer à l'avis éditeur pour la liste exacte des produits RUGGEDCOM concernés et des correctifs disponibles | ||
Siemens | N/A | Parasolid V34.0 versions antérieures à 34.0.250 | ||
Siemens | N/A | SIMATIC MV550 H (6GF3550-0GE10) versions antérieures à 3.3 | ||
Siemens | N/A | Mendix Applications using Mendix 9 versions 9.12 antérieure à 9.12.3 | ||
Siemens | N/A | Mendix Applications using Mendix versions 7 antérieures à 7.23.31 | ||
Siemens | N/A | CP-8021 MASTER MODULE (6MF2802-1AA00) versions antérieures à CPC80 V16.30 | ||
Siemens | N/A | Simcenter Femap versions antérieures à 2022.2 | ||
Siemens | N/A | EN100 Ethernet module PROFINET IO variant toutes versions | ||
Siemens | N/A | SICAM GridEdge Essential Intel (6MD7881-2AA40) versions antérieures à 2.7.3 | ||
Siemens | N/A | SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) versions antérieures à 2.0 | ||
Siemens | N/A | CP-8000 MASTER MODULE WITH I/O -40/+70°C (6MF2101-1AB10-0AA0) versions antérieures à CPC80 V16.30 | ||
Siemens | N/A | SIMATIC MV550 S (6GF3550-0CD10) versions antérieures à 3.3 | ||
Siemens | N/A | SICAM GridEdge Essential with GDS ARM (6MD7881-2AA10) toutes versions | ||
Siemens | N/A | Mendix Applications using Mendix 9 versions supérieures ou égales à 9.11 et antérieures à 9.15 | ||
Siemens | N/A | EN100 Ethernet module DNP3 IP variant toutes versions | ||
Siemens | N/A | Parasolid V33.1 toutes versions | ||
Siemens | N/A | JT2Go versions antérieures à 13.3.0.5 | ||
Siemens | N/A | Opcenter Quality versions 13.1 antérieures à 13.1.20220624 | ||
Siemens | N/A | EN100 Ethernet module IEC 61850 variant versions antérieures à 4.40 | ||
Siemens | N/A | SIMATIC MV560 X (6GF3560-0HE10) versions antérieures à 3.3 | ||
Siemens | N/A | Simcenter Femap toutes versions | ||
Siemens | N/A | Teamcenter Visualization V14.0 toutes versions | ||
Siemens | N/A | Teamcenter Visualization V13.2 toutes versions | ||
Siemens | N/A | SIMATIC MV560 U (6GF3560-0LE10) versions antérieures à 3.3 | ||
Siemens | N/A | Mendix Applications using Mendix versions 9 antérieures à 9.14.0 | ||
Siemens | N/A | Mendix Excel Importer Module (Mendix 9 compatible) versions antérieures à 10.1.2 | ||
Siemens | N/A | CP-8022 MASTER MODULE WITH GPRS (6MF2802-2AA00) versions antérieures à CPC80 V16.30 | ||
Siemens | N/A | SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8) versions antérieures à 22.00 | ||
Siemens | N/A | SICAM GridEdge Essential with GDS Intel (6MD7881-2AA20) versions antérieures à 2.7.3 | ||
Siemens | N/A | Disques SINAMICS PERFECT HARMONY GH180 Drives fabriqués depuis 2015 avant 2021 | ||
Siemens | N/A | SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) à SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) toutes versions : Se référer à l'avis éditeur pour la liste exacte des produits SCALANCE concernés et des correctifs disponibles | ||
Siemens | N/A | SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) versions antérieures à 2.0 | ||
Siemens | N/A | SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) toutes versions | ||
Siemens | N/A | CP-8000 MASTER MODULE WITH I/O -25/+70°C (6MF2101-0AB10-0AA0) versions antérieures à CPC80 V16.30 | ||
Siemens | N/A | Mendix Applications using Mendix versions 9 (9.6) antérieures à 9.6.12 | ||
Siemens | N/A | PADS Standard/Plus Viewer toutes versions | ||
Siemens | N/A | SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) toutes versions : Se référer à l'avis éditeur pour la liste exacte des produits SIMATIC concernés et des correctifs disponibles | ||
Siemens | N/A | Parasolid V34.1 versions antérieures à 34.1.233 |
{ "$ref": "https://www.cert.ssi.gouv.fr/openapi.json", "affected_systems": [ { "description": "Mendix Applications using Mendix versions 9 (9.12) ant\u00e9rieures \u00e0 9.12.2", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Teamcenter Visualization V12.4 toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0) versions ant\u00e9rieures \u00e0 3.0.22", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "EN100 Ethernet module IEC 104 variant toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC CP 1543SP-1 (6GK7543-6WX00-0XE0) versions ant\u00e9rieures \u00e0 2.0", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS NET CP 1242-7 V2 (6AG1242-7KX31-7XE0) toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC CP 1542SP-1 IRC (6GK7542-6VX00-0XE0) versions ant\u00e9rieures \u00e0 2.0", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0) versions ant\u00e9rieures \u00e0 3.0.22", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SICAM GridEdge Essential ARM (6MD7881-2AA30) toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Applications using Mendix versions 8 ant\u00e9rieures \u00e0 8.18.18", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "EN100 Ethernet module Modbus TCP variant toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) \u00e0 SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0) toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Teamcenter Visualization toutes versions 14.0.x", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "RUGGEDCOM ROX MX5000 \u00e0 RX5000 versions ant\u00e9rieures \u00e0 2.15.1", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Excel Importer Module (Mendix 8 compatible) versions ant\u00e9rieures \u00e0 9.2.2", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC MV540 H (6GF3540-0GE10) versions ant\u00e9rieures \u00e0 3.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS ET 200SP CP 1543SP-1 ISEC (6AG1543-6WX00-7XE0) versions ant\u00e9rieures \u00e0 2.0", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Opcenter Quality versions 13.2 ant\u00e9rieures \u00e0 13.2.20220624", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC MV540 S (6GF3540-0CD10) versions ant\u00e9rieures \u00e0 3.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Teamcenter Visualization versions 13.3.x ant\u00e9rieures \u00e0 13.3.0.5", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "RUGGEDCOM ROS toutes versions : Se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour la liste exacte des produits RUGGEDCOM concern\u00e9s et des correctifs disponibles", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Parasolid V34.0 versions ant\u00e9rieures \u00e0 34.0.250", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC MV550 H (6GF3550-0GE10) versions ant\u00e9rieures \u00e0 3.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Applications using Mendix 9 versions 9.12 ant\u00e9rieure \u00e0 9.12.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Applications using Mendix versions 7 ant\u00e9rieures \u00e0 7.23.31", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "CP-8021 MASTER MODULE (6MF2802-1AA00) versions ant\u00e9rieures \u00e0 CPC80 V16.30", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Simcenter Femap versions ant\u00e9rieures \u00e0 2022.2", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "EN100 Ethernet module PROFINET IO variant toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SICAM GridEdge Essential Intel (6MD7881-2AA40) versions ant\u00e9rieures \u00e0 2.7.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (6AG2542-6VX00-4XE0) versions ant\u00e9rieures \u00e0 2.0", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "CP-8000 MASTER MODULE WITH I/O -40/+70\u00b0C (6MF2101-1AB10-0AA0) versions ant\u00e9rieures \u00e0 CPC80 V16.30", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC MV550 S (6GF3550-0CD10) versions ant\u00e9rieures \u00e0 3.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SICAM GridEdge Essential with GDS ARM (6MD7881-2AA10) toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Applications using Mendix 9 versions sup\u00e9rieures ou \u00e9gales \u00e0 9.11 et ant\u00e9rieures \u00e0 9.15", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "EN100 Ethernet module DNP3 IP variant toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Parasolid V33.1 toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "JT2Go versions ant\u00e9rieures \u00e0 13.3.0.5", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Opcenter Quality versions 13.1 ant\u00e9rieures \u00e0 13.1.20220624", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "EN100 Ethernet module IEC 61850 variant versions ant\u00e9rieures \u00e0 4.40", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC MV560 X (6GF3560-0HE10) versions ant\u00e9rieures \u00e0 3.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Simcenter Femap toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Teamcenter Visualization V14.0 toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Teamcenter Visualization V13.2 toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC MV560 U (6GF3560-0LE10) versions ant\u00e9rieures \u00e0 3.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Applications using Mendix versions 9 ant\u00e9rieures \u00e0 9.14.0", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Excel Importer Module (Mendix 9 compatible) versions ant\u00e9rieures \u00e0 10.1.2", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "CP-8022 MASTER MODULE WITH GPRS (6MF2802-2AA00) versions ant\u00e9rieures \u00e0 CPC80 V16.30", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIMATIC eaSie Core Package (6DL5424-0AX00-0AV8) versions ant\u00e9rieures \u00e0 22.00", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SICAM GridEdge Essential with GDS Intel (6MD7881-2AA20) versions ant\u00e9rieures \u00e0 2.7.3", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Disques SINAMICS PERFECT HARMONY GH180 Drives fabriqu\u00e9s depuis 2015 avant 2021", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) \u00e0 SCALANCE X200-4P IRT (6GK5200-4AH00-2BA3) toutes versions : Se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour la liste exacte des produits SCALANCE concern\u00e9s et des correctifs disponibles", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (6AG2543-6WX00-4XE0) versions ant\u00e9rieures \u00e0 2.0", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS S7-1200 CP 1243-1 (6AG1243-1BX30-2AX0) toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "CP-8000 MASTER MODULE WITH I/O -25/+70\u00b0C (6MF2101-0AB10-0AA0) versions ant\u00e9rieures \u00e0 CPC80 V16.30", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Mendix Applications using Mendix versions 9 (9.6) ant\u00e9rieures \u00e0 9.6.12", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "PADS Standard/Plus Viewer toutes versions", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "SIPLUS S7-1200 CP 1243-1 RAIL (6AG2243-1BX30-1XE0) toutes versions : Se r\u00e9f\u00e9rer \u00e0 l\u0027avis \u00e9diteur pour la liste exacte des produits SIMATIC concern\u00e9s et des correctifs disponibles", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } }, { "description": "Parasolid V34.1 versions ant\u00e9rieures \u00e0 34.1.233", "product": { "name": "N/A", "vendor": { "name": "Siemens", "scada": true } } } ], "affected_systems_content": null, "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n", "cves": [ { "name": "CVE-2022-34820", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34820" }, { "name": "CVE-2022-34819", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34819" }, { "name": "CVE-2022-34277", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34277" }, { "name": "CVE-2022-31257", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31257" }, { "name": "CVE-2022-34288", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34288" }, { "name": "CVE-2022-29884", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29884" }, { "name": "CVE-2022-34280", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34280" }, { "name": "CVE-2022-28809", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28809" }, { "name": "CVE-2022-34663", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34663" }, { "name": "CVE-2022-34286", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34286" }, { "name": "CVE-2021-44222", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44222" }, { "name": "CVE-2022-29560", "url": "https://www.cve.org/CVERecord?id=CVE-2022-29560" }, { "name": "CVE-2022-34748", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34748" }, { "name": "CVE-2022-34287", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34287" }, { "name": "CVE-2022-34275", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34275" }, { "name": "CVE-2022-34291", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34291" }, { "name": "CVE-2022-34274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34274" }, { "name": "CVE-2022-34273", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34273" }, { "name": "CVE-2022-28808", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28808" }, { "name": "CVE-2021-29998", "url": "https://www.cve.org/CVERecord?id=CVE-2021-29998" }, { "name": "CVE-2022-33736", "url": "https://www.cve.org/CVERecord?id=CVE-2022-33736" }, { "name": "CVE-2022-34466", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34466" }, { "name": "CVE-2022-34272", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34272" }, { "name": "CVE-2022-34284", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34284" }, { "name": "CVE-2022-26648", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26648" }, { "name": "CVE-2022-34276", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34276" }, { "name": "CVE-2022-34289", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34289" }, { "name": "CVE-2022-34821", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34821" }, { "name": "CVE-2022-28807", "url": "https://www.cve.org/CVERecord?id=CVE-2022-28807" }, { "name": "CVE-2022-34465", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34465" }, { "name": "CVE-2022-33137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-33137" }, { "name": "CVE-2022-34283", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34283" }, { "name": "CVE-2022-34278", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34278" }, { "name": "CVE-2022-34282", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34282" }, { "name": "CVE-2022-34290", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34290" }, { "name": "CVE-2022-26647", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26647" }, { "name": "CVE-2022-34279", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34279" }, { "name": "CVE-2022-34467", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34467" }, { "name": "CVE-2022-34281", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34281" }, { "name": "CVE-2022-26649", "url": "https://www.cve.org/CVERecord?id=CVE-2022-26649" }, { "name": "CVE-2021-44221", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44221" }, { "name": "CVE-2022-34464", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34464" }, { "name": "CVE-2022-34285", "url": "https://www.cve.org/CVERecord?id=CVE-2022-34285" }, { "name": "CVE-2022-33138", "url": "https://www.cve.org/CVERecord?id=CVE-2022-33138" }, { "name": "CVE-2022-2069", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2069" }, { "name": "CVE-2022-30938", "url": "https://www.cve.org/CVERecord?id=CVE-2022-30938" } ], "initial_release_date": "2022-07-12T00:00:00", "last_revision_date": "2022-07-12T00:00:00", "links": [], "reference": "CERTFR-2022-AVI-627", "revisions": [ { "description": "Version initiale", "revision_date": "2022-07-12T00:00:00.000000" } ], "risks": [ { "description": "D\u00e9ni de service \u00e0 distance" }, { "description": "Ex\u00e9cution de code arbitraire \u00e0 distance" }, { "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es" }, { "description": "Contournement de la politique de s\u00e9curit\u00e9" }, { "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es" }, { "description": "\u00c9l\u00e9vation de privil\u00e8ges" } ], "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSiemens. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer\nune ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n", "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Siemens", "vendor_advisories": [ { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-517377 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-517377.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-599506 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-599506.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-243317 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-243317.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-429204 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-429204.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-829738 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-829738.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-610768 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-610768.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-492173 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-492173.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-348662 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-348662.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-580125 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-580125.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-840800 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-840800.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-225578 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-225578.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-491621 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-491621.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-433782 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-433782.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-910883 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-910883.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-474231 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-474231.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-865333 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-865333.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-439148 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-439148.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-310038 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-310038.html" }, { "published_at": null, "title": "Bulletin de s\u00e9curit\u00e9 Siemens ssa-944952 du 12 juillet 2022", "url": "https://cert-portal.siemens.com/productcert/html/ssa-944952.html" } ] }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.