Buffer overflow in Siemens products - CVE-2024-22039

Vulnerability identifier: #VU87488

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22039

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the network communication library. A remote attacker can trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Cerberus PRO EN Engineering Tool
Cerberus PRO EN Fire Panel FC72x
Sinteso FS20 EN Engineering Tool
Sinteso FS20 EN Fire Panel FC20
Sinteso Mobile
Cerberus PRO EN X200 Cloud Distribution
Sinteso FS20 EN X200 Cloud Distribution
Cerberus PRO EN X300 Cloud Distribution
Sinteso FS20 EN X300 Cloud Distribution

Install updates from vendor's website.

Cerberus PRO EN Engineering Tool - update to IP8
Cerberus PRO EN Fire Panel FC72x - update to IP8
Sinteso FS20 EN Engineering Tool - update to MP8
Sinteso FS20 EN Fire Panel FC20 - update to MP8
Sinteso Mobile - update to 3.0.0
Cerberus PRO EN X200 Cloud Distribution - update to 4.0.5016
Sinteso FS20 EN X200 Cloud Distribution - update to 4.0.5016
Cerberus PRO EN X300 Cloud Distribution - update to 4.2.5015
Sinteso FS20 EN X300 Cloud Distribution - update to 4.2.5015

• https://cert-portal.siemens.com/productcert/html/ssa-225840.html

• Remote code execution in Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems