Main Vulnerability Database Vulnerabilities #VU65281

Buffer overflow in Siemens products - CVE-2022-30938

Published: July 13, 2022 / Updated: July 14, 2022

Vulnerability identifier: #VU65281

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-30938

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error while parsing specially crafted HTTP packets. A remote attacker can trigger memory corruption and cause a denial of service condition on the target system.

Affected software

EN100 Ethernet module DNP3 IP variant
EN100 Ethernet module IEC 104 variant
EN100 Ethernet module Modbus TCP variant
EN100 Ethernet module PROFINET IO variant
EN100 Ethernet module IEC 61850 variant

How to mitigate CVE-2022-30938

Install updates from vendor's website.

EN100 Ethernet module IEC 61850 variant - update to 4.40

External References

https://cert-portal.siemens.com/productcert/pdf/ssa-865333.pdficsa-22-195-16

Related Security Bulletins