Input validation error in Siemens Hardware solutions

#VU68287 Input validation error in Siemens Hardware solutions

Published: 2022-10-13

Vulnerability identifier: #VU68287

Vulnerability risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-31766

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vendor: Siemens

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input when TCP Event service is enabled. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

SCALANCE WAM763-1: 1.1.0

SCALANCE WAM766-1: 1.1.0

SCALANCE WAM766-1 6GHz: 1.1.0

SCALANCE WAM766-1 EEC: 1.1.0

SCALANCE WAM766-1 EEC 6GHz: 1.1.0

SCALANCE WUM763-1: 1.1.0

SCALANCE WUM766-1: 1.1.0

SCALANCE WUM766-1 6GHz: 1.1.0

External links
http://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability

Denial of service in Siemens SCALANCE and RUGGEDCOM Products