Time-of-check Time-of-use (TOCTOU) Race Condition in Siemens products - CVE-2022-30774

Vulnerability identifier: #VU72377

CSH Severity: Low

CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-30774

CWE-ID: CWE-367

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerable software:
RUGGEDCOM APE1808 ADM
RUGGEDCOM APE1808 ADM CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S3
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808W10 CC

Software vendor:
Siemens

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a time-of-check-time-of-use (TOCTOU) race condition within the PnpSmm driver. A local administrator can gain elevated privileges on the target system.

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf