Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Out-of-Bounds Read Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels, detection and management stations. It complies with the European standard EN 54 for fire detection and alarm systems. Sinteso Mobile is a mobile application for remote access to the Sinteso/Cerberus PRO EN fire protection system. An out-of-bounds read leak exists in Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems due to a network communication library in the affected systems that does not adequately validate HMAC values, which could be exploited by an attacker to crash network services.