Lucene search

SiemensCVE-2022-30937

HistoryJun 14, 2022 - 10:15 a.m.

CVE-2022-30937

2022-06-1410:15:20

CWE-119

CWE-787

siemens

web.nvd.nist.gov

cve

en100

ethernet module

dnp3

ip variant

iec 104 variant

iec 61850 variant

modbus tcp variant

profinet io variant

http packets

denial of service

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

33.4%

JSON

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint. This could allow an attacker to crash the affected application leading to a denial of service condition.

Affected configurations

Nvd

Node

siemensen100_ethernet_module_dnp3_firmwareMatch-

siemensen100_ethernet_module_iec_104_firmwareMatch-

siemensen100_ethernet_module_iec_61850_firmwareRange<4.37

siemensen100_ethernet_module_modbus_tcp_firmwareMatch-

siemensen100_ethernet_module_profinet_io_firmwareMatch-

AND

siemensen100_ethernet_moduleMatch-

VendorProductVersionCPE
siemensen100_ethernet_module_dnp3_firmware-cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:*:*:*:*:*:*:*
siemensen100_ethernet_module_iec_104_firmware-cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:*:*:*:*:*:*:*
siemensen100_ethernet_module_iec_61850_firmware*cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware:*:*:*:*:*:*:*:*
siemensen100_ethernet_module_modbus_tcp_firmware-cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:-:*:*:*:*:*:*:*
siemensen100_ethernet_module_profinet_io_firmware-cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:*:*:*:*:*:*:*
siemensen100_ethernet_module-cpe:2.3:h:siemens:en100_ethernet_module:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
siemens	en100_ethernet_module_dnp3_firmware	-	cpe:2.3:o:siemens:en100_ethernet_module_dnp3_firmware:-:::::::*
siemens	en100_ethernet_module_iec_104_firmware	-	cpe:2.3:o:siemens:en100_ethernet_module_iec_104_firmware:-:::::::*
siemens	en100_ethernet_module_iec_61850_firmware	*	cpe:2.3:o:siemens:en100_ethernet_module_iec_61850_firmware::::::::
siemens	en100_ethernet_module_modbus_tcp_firmware	-	cpe:2.3:o:siemens:en100_ethernet_module_modbus_tcp_firmware:-:::::::*
siemens	en100_ethernet_module_profinet_io_firmware	-	cpe:2.3:o:siemens:en100_ethernet_module_profinet_io_firmware:-:::::::*
siemens	en100_ethernet_module	-	cpe:2.3:h:siemens:en100_ethernet_module:-:::::::*

CNA Affected

[
  {
    "product": "EN100 Ethernet module DNP3 IP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 104 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 61850 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.37"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module Modbus TCP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module PROFINET IO variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf

Social References

CVSS2

7.8

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

33.4%

JSON

Related for CVE-2022-30937