Time-of-check Time-of-use (TOCTOU) Race Condition in Siemens products - CVE-2022-24351

Vulnerability identifier: #VU80878

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2022-24351

CWE-ID: CWE-367

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Siemens

Affected software:
RUGGEDCOM APE1808 ADM
RUGGEDCOM APE1808 ADM CC
RUGGEDCOM APE1808 CKP
RUGGEDCOM APE1808 CKP CC
RUGGEDCOM APE1808 CLOUDCONNECT
RUGGEDCOM APE1808 CLOUDCONNECT CC
RUGGEDCOM APE1808 ELAN
RUGGEDCOM APE1808 ELAN CC
RUGGEDCOM APE1808 SAM-L
RUGGEDCOM APE1808 SAM-L CC
RUGGEDCOM APE1808CLA-P
RUGGEDCOM APE1808CLA-P CC
RUGGEDCOM APE1808CLA-S1
RUGGEDCOM APE1808CLA-S1 CC
RUGGEDCOM APE1808CLA-S3
RUGGEDCOM APE1808CLA-S3 CC
RUGGEDCOM APE1808CLA-S5
RUGGEDCOM APE1808CLA-S5 CC
RUGGEDCOM APE1808LNX
RUGGEDCOM APE1808LNX CC
RUGGEDCOM APE1808W10
RUGGEDCOM APE1808W10 CC

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to a time-of-check, time-of-use (TOCTOU) race condition. A local attacker can alter data and code used by the remainder of the boot process.

Install updates from vendor's website.

• https://cert-portal.siemens.com/productcert/txt/ssa-957369.txt