#VU72377 Time-of-check Time-of-use (TOCTOU) Race Condition in Siemens products - CVE-2022-30774

Cybersecurity Help s.r.o.

Published: 2023-02-20 | Updated: 2023-02-22

Vulnerability identifier: #VU72377

Vulnerability risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-30774

CWE-ID: CWE-367

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
RUGGEDCOM APE1808 ADM
Hardware solutions / Firmware
RUGGEDCOM APE1808 ADM CC
Hardware solutions / Firmware
RUGGEDCOM APE1808 CKP
Hardware solutions / Firmware
RUGGEDCOM APE1808 CKP CC
Hardware solutions / Firmware
RUGGEDCOM APE1808 CLOUDCONNECT
Hardware solutions / Firmware
RUGGEDCOM APE1808 CLOUDCONNECT CC
Hardware solutions / Firmware
RUGGEDCOM APE1808 ELAN
Hardware solutions / Firmware
RUGGEDCOM APE1808 ELAN CC
Hardware solutions / Firmware
RUGGEDCOM APE1808 SAM-L
Hardware solutions / Firmware
RUGGEDCOM APE1808 SAM-L CC
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-P
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-P CC
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-S1
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-S1 CC
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-S3
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-S3 CC
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-S5
Hardware solutions / Firmware
RUGGEDCOM APE1808CLA-S5 CC
Hardware solutions / Firmware
RUGGEDCOM APE1808LNX
Hardware solutions / Firmware
RUGGEDCOM APE1808LNX CC
Hardware solutions / Firmware
RUGGEDCOM APE1808W10
Hardware solutions / Firmware
RUGGEDCOM APE1808W10 CC
Hardware solutions / Firmware

Vendor: Siemens

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a time-of-check-time-of-use (TOCTOU) race condition within the PnpSmm driver. A local administrator can gain elevated privileges on the target system.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

RUGGEDCOM APE1808 ADM: All versions

RUGGEDCOM APE1808 ADM CC: All versions

RUGGEDCOM APE1808 CKP: All versions

RUGGEDCOM APE1808 CKP CC: All versions

RUGGEDCOM APE1808 CLOUDCONNECT: All versions

RUGGEDCOM APE1808 CLOUDCONNECT CC: All versions

RUGGEDCOM APE1808 ELAN: All versions

RUGGEDCOM APE1808 ELAN CC: All versions

RUGGEDCOM APE1808 SAM-L: All versions

RUGGEDCOM APE1808 SAM-L CC: All versions

RUGGEDCOM APE1808CLA-P: All versions

RUGGEDCOM APE1808CLA-P CC: All versions

RUGGEDCOM APE1808CLA-S1: All versions

RUGGEDCOM APE1808CLA-S1 CC: All versions

RUGGEDCOM APE1808CLA-S3: All versions

RUGGEDCOM APE1808CLA-S3 CC: All versions

RUGGEDCOM APE1808CLA-S5: All versions

RUGGEDCOM APE1808CLA-S5 CC: All versions

RUGGEDCOM APE1808LNX: All versions

RUGGEDCOM APE1808LNX CC: All versions

RUGGEDCOM APE1808W10: All versions

RUGGEDCOM APE1808W10 CC: All versions

External links
https://cert-portal.siemens.com/productcert/pdf/ssa-450613.pdf
icsa-23-047-08

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Latest bulletins with this vulnerability

Multiple vulnerabilities in Siemens RUGGEDCOM APE1808 Product Family