Lucene search

K

[email protected]CVE-2022-30938

HistoryJul 12, 2022 - 10:15 a.m.

CVE-2022-30938

2022-07-1210:15:10

CWE-119

CWE-787

[email protected]

web.nvd.nist.gov

43

3

cve-2022-30938

vulnerability

en100

ethernet module

memory corruption

http packets

denial of service

nvd

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.6%

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.40), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint manupulating a specific argument. This could allow an attacker to crash the affected application leading to a denial of service condition

Affected configurations

NVD

Node

siemensen100_ethernet_module_dnp3_ip_firmware

AND

siemensen100_ethernet_moduleMatch-

Node

siemensen100_ethernet_module_iec_104_firmware

AND

siemensen100_ethernet_moduleMatch-

Node

siemensen100_ethernet_module_iec_61850_firmwareRange<4.40

AND

siemensen100_ethernet_moduleMatch-

Node

siemensen100_ethernet_module_modbus_tcp_firmware

AND

siemensen100_ethernet_moduleMatch-

Node

siemensen100_ethernet_module_profinet_io_firmwareMatch-

AND

siemensen100_ethernet_moduleMatch-

CPENameOperatorVersion
siemens:en100_ethernet_module_dnp3_ip_firmwaresiemens en100 ethernet module dnp3 ip firmwareeq*

CNA Affected

[
  {
    "product": "EN100 Ethernet module DNP3 IP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 104 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module IEC 61850 variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions < V4.40"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module Modbus TCP variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  },
  {
    "product": "EN100 Ethernet module PROFINET IO variant",
    "vendor": "Siemens",
    "versions": [
      {
        "status": "affected",
        "version": "All versions"
      }
    ]
  }
]

References

cert-portal.siemens.com/productcert/pdf/ssa-865333.pdf

Social References

More

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

33.6%

Related for CVE-2022-30938

cvelist1 nessus1 ics1 prion1 nvd1