Main Vulnerability Database Vulnerabilities #VU64401

Buffer overflow in Siemens products - CVE-2022-30937

Published: June 15, 2022

Vulnerability identifier: #VU64401

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30937

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when parsing specially crafted HTTP packets to /txtrace endpoint. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

Affected software

EN100 Ethernet module DNP3 IP variant
EN100 Ethernet module IEC 104 variant
EN100 Ethernet module IEC 61850 variant
EN100 Ethernet module Modbus TCP variant
EN100 Ethernet module PROFINET IO variant

How to mitigate CVE-2022-30937

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

External References

https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf

Related Security Bulletins

Denial of service in Siemens EN100 Ethernet Module