Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2023-45863)

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an attacker can trigger a race condition that results in a fillkobjpath out-of-bounds write. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

Siemens SCALANCE W700 Improper Input Validation (CVE-2023-28578)

Memory corruption in Core Services while executing the command for removing a single event listener. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...

Siemens SCALANCE W700 Out-of-bounds Write (CVE-2023-2194)

An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. The userspace data-block0 variable was not capped to a number between 0-255 and was used as the size of a memcpy, possibly writing beyond the end of dmabuffer. This flaw could allow a local privileged...

Siemens SCALANCE W700 Integer Overflow or Wraparound (CVE-2022-39842)

An issue was discovered in the Linux kernel before 5.19. In pxa3xxgcuwrite in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of sizet versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2023-3611)

An out-of-bounds write vulnerability in the Linux kernel's net/sched: schqfq component can be exploited to achieve local privilege escalation. The qfqchangeagg function in net/sched/schqfq.c allows an out-of-bounds write because lmax is updated according to packet sizes without bounds checks. Thi...

Siemens SIMATIC and SCALANCE Devices NULL Pointer Dereference (CVE-2023-42754)

A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer skb was assumed to be associated with a device before calling ipoptionscompile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAPNETADMIN privileges t...

Siemens SCALANCE W700 Integer Overflow or Wraparound (CVE-2023-45853)

MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip464 via a long filename, comment, or extra field. NOTE: MiniZip is not a supported part of the zlib product. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC and SCALANCE Devices Improper Restriction of Communication Channel to Intended Endpoints (CVE-2022-2663)

An issue was found in the Linux kernel in nfconntrackirc where the message handling can be confused and incorrectly matches the message. A firewall may be able to be bypassed when users are using unencrypted IRC with nfconntrackirc configured. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC and SCALANCE Devices Missing Critical Step in Authentication (CVE-2023-51384)

In ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied. When destination constraints are specified during addition of PKCS11-hosted private keys, these constraints are only applied to the first key, even if a PKCS11 token returns multiple keys. This plugin...

Siemens SCALANCE W700 Missing Release of Memory after Effective Lifetime (CVE-2023-1074)

A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious networking service and someone connects to this service. This could allow a local user to starve resources, causing a denial of service. This plugin only...

Siemens SCALANCE W700 Uncontrolled Resource Consumption (CVE-2024-23814)

The integrated ICMP service of the network stack of affected devices can be forced to exhaust its available memory resources when receiving specially crafted messages targeting IP fragment re- assembly. This could allow an unauthenticated remote attacker to cause a temporary denial of service...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2022-43750)

drivers/usb/mon/monbin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 8090...

Siemens SIMATIC and SCALANCE Devices NULL Pointer Dereference (CVE-2022-47929)

In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service system crash via a crafted traffic control configuration that is set up with tc qdisc and tc class commands. This affects qdiscgraft in...

Siemens SCALANCE W700 Out-of-bounds Read (CVE-2023-1380)

A slab-out-of-bound read problem was found in brcmfgetassocies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when associnfo-reqlen data is bigger than the size of the buffer, defined as WLEXTRABUFMAX, leading to a denial of service. Thi...

Siemens SCALANCE W700 Use After Free (CVE-2023-1670)

A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA PC- card Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2023-35001)

Linux Kernel nftables Out-Of-Bounds Read/Write Vulnerability; nftbyteorder poorly handled vm register contents when CAPNETADMIN is in any user or network namespace This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL...

Siemens SIMATIC and SCALANCE Devices Out-of-bounds Write (CVE-2024-9143)

Use of the low-level GF2m elliptic curve APIs with untrusted explicit values for the field polynomial can lead to out-of-bounds memory reads or writes. Impact summary: Out of bound memory writes can lead to an application crash or even a possibility of a remote code execution, however, in all the...

Siemens SIMATIC and SCALANCE Devices Exposure of Sensitive Information to an Unauthorized Actor (CVE-2024-5535)

Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. A buffer overread can have a range of potential consequences such as unexpected application beahviour or a crash. In particular this iss...

Siemens SIMATIC and SCALANCE Devices Race Condition (CVE-2022-39188)

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition unmapmappingrange versus munmap, a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VMPFNMAP VMAs. This plugin only works with...

Siemens SCALANCE W700 Improper Input Validation (CVE-2025-24499)

Affected devices do not properly validate input while loading the configuration files. This could allow an authenticated remote attacker to execute arbitrary shell commands on the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...