Out-of-bounds read in Siemens products - CVE-2024-22040

Vulnerability identifier: #VU87491

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-22040

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition in the network communication library. A remote attacker can trigger an out-of-bounds read error and cause a denial of service condition on the system.

Cerberus PRO EN Engineering Tool
Sinteso FS20 EN Engineering Tool
Sinteso Mobile
Cerberus PRO EN Fire Panel FC72x
Sinteso FS20 EN Fire Panel FC20
Cerberus PRO EN X300 Cloud Distribution
Sinteso FS20 EN X300 Cloud Distribution
Cerberus PRO EN X200 Cloud Distribution
Sinteso FS20 EN X200 Cloud Distribution

Install updates from vendor's website.

Cerberus PRO EN Fire Panel FC72x - update to IP8 SR4
Sinteso FS20 EN Fire Panel FC20 - update to MP8 SR4
Cerberus PRO EN X300 Cloud Distribution - update to 4.3.5617
Sinteso FS20 EN X300 Cloud Distribution - update to 4.3.5617
Cerberus PRO EN X200 Cloud Distribution - update to 4.3.5618
Sinteso FS20 EN X200 Cloud Distribution - update to 4.3.5618

• https://cert-portal.siemens.com/productcert/html/ssa-225840.html

• Multiple vulnerabilities in Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems