Risk | High |
Patch available | YES |
Number of vulnerabilities | 1 |
CVE-ID | CVE-2022-31766 |
CWE-ID | CWE-20 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software |
SCALANCE WAM763-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM766-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM766-1 6GHz Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM766-1 EEC Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WAM766-1 EEC 6GHz Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WUM763-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WUM766-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE WUM766-1 6GHz Hardware solutions / Routers & switches, VoIP, GSM, etc RUGGEDCOM RM1224 LTE Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M804PB Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M812-1 ADSL-Router (Annex A) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M812-1 ADSL-Router (Annex B) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M816-1 ADSL-Router (Annex A) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M816-1 ADSL-Router (Annex B) Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M826-2 SHDSL-Router Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M874-2 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M874-3 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-3 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE M876-4 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE MUM853-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE MUM856-1 Hardware solutions / Routers & switches, VoIP, GSM, etc SCALANCE S615 Hardware solutions / Firmware |
Vendor | Siemens |
Security Bulletin
This security bulletin contains one high risk vulnerability.
EUVDB-ID: #VU68287
Risk: High
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID: CVE-2022-31766
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when TCP Event service is enabled. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSCALANCE WAM763-1: - - 1.1.0
SCALANCE WAM766-1: - - 1.1.0
SCALANCE WAM766-1 6GHz: - - 1.1.0
SCALANCE WAM766-1 EEC: - - 1.1.0
SCALANCE WAM766-1 EEC 6GHz: - - 1.1.0
SCALANCE WUM763-1: - - 1.1.0
SCALANCE WUM766-1: - - 1.1.0
SCALANCE WUM766-1 6GHz: - - 1.1.0
RUGGEDCOM RM1224 LTE: before 7.1.2
SCALANCE M804PB: before 7.1.2
SCALANCE M812-1 ADSL-Router (Annex A): before 7.1.2
SCALANCE M812-1 ADSL-Router (Annex B): before 7.1.2
SCALANCE M816-1 ADSL-Router (Annex A): before 7.1.2
SCALANCE M816-1 ADSL-Router (Annex B): before 7.1.2
SCALANCE M826-2 SHDSL-Router: before 7.1.2
SCALANCE M874-2: before 7.1.2
SCALANCE M874-3: before 7.1.2
SCALANCE M876-3: before 7.1.2
SCALANCE M876-4: before 7.1.2
SCALANCE MUM853-1: before 7.1.2
SCALANCE MUM856-1: before 7.1.2
SCALANCE S615: before 7.1.2
CPE2.3https://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.