github - ghsa-xxp6-493w-583x

ghsa-xxp6-493w-583x

Vulnerability from github

Published

2022-04-13 00:00

Modified

2022-04-20 00:00

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Details

A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition.

Show details on source website

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-28328"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-04-12T09:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions \u003c V3.0.0), SCALANCE W1788-2 EEC M12 (All versions \u003c V3.0.0), SCALANCE W1788-2 M12 (All versions \u003c V3.0.0), SCALANCE W1788-2IA M12 (All versions \u003c V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition.",
  "id": "GHSA-xxp6-493w-583x",
  "modified": "2022-04-20T00:00:50Z",
  "published": "2022-04-13T00:00:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28328"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2022-28328 (GCVE-0-2022-28328)

Vulnerability from cvelistv5

Published

2022-04-12 09:08

Modified

2024-08-03 05:48

Severity ?

CWE

CWE-20 - Improper Input Validation

Summary

A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition.

References

URL

Tags

https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf

x_refsource_MISC

Impacted products

Vendor

Product

Version

SCALANCE W1788-1 M12

Version: All versions < V3.0.0

	Siemens	SCALANCE W1788-2 EEC M12	Version: All versions < V3.0.0
	Siemens	SCALANCE W1788-2 M12	Version: All versions < V3.0.0
	Siemens	SCALANCE W1788-2IA M12	Version: All versions < V3.0.0

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T05:48:38.169Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SCALANCE W1788-1 M12",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.0.0"
            }
          ]
        },
        {
          "product": "SCALANCE W1788-2 EEC M12",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.0.0"
            }
          ]
        },
        {
          "product": "SCALANCE W1788-2 M12",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.0.0"
            }
          ]
        },
        {
          "product": "SCALANCE W1788-2IA M12",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V3.0.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions \u003c V3.0.0), SCALANCE W1788-2 EEC M12 (All versions \u003c V3.0.0), SCALANCE W1788-2 M12 (All versions \u003c V3.0.0), SCALANCE W1788-2IA M12 (All versions \u003c V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-12T09:08:06",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "productcert@siemens.com",
          "ID": "CVE-2022-28328",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SCALANCE W1788-1 M12",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V3.0.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE W1788-2 EEC M12",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V3.0.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE W1788-2 M12",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V3.0.0"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SCALANCE W1788-2IA M12",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "All versions \u003c V3.0.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Siemens"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions \u003c V3.0.0), SCALANCE W1788-2 EEC M12 (All versions \u003c V3.0.0), SCALANCE W1788-2 M12 (All versions \u003c V3.0.0), SCALANCE W1788-2IA M12 (All versions \u003c V3.0.0). Affected devices do not properly handle malformed Multicast LLC frames. This could allow an attacker to trigger a denial of service condition."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20: Improper Input Validation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf",
              "refsource": "MISC",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2022-28328",
    "datePublished": "2022-04-12T09:08:06",
    "dateReserved": "2022-04-01T00:00:00",
    "dateUpdated": "2024-08-03T05:48:38.169Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.