Skip to content
OpenAdvisories
High ICSA-20-105-05 2 CVEs

Siemens RUGGEDCOM, SCALANCE, SIMATIC, SINEMA (Update B)

Published Apr 14, 2020 · Updated Sep 8, 2020 · Revision 3

Vendor: Siemens Product: RUGGEDCOM RM1224 Product: RUGGEDCOM ROX II Product: SCALANCE M-800 / S615 Product: SCALANCE SC-600 Product: SCALANCE W1700 IEEE 802.11ac Product: SCALANCE W700 IEEE 802.11a/b/g/n Product: SIMATIC NET CP 1242-7 Product: SIMATIC NET CP 1243-1 (incl.'SIPLUS variants) Product: SIMATIC NET CP 1243-7 LTE EU Product: SIMATIC NET CP 1243-7 LTE US Product: SIMATIC NET CP 1243-8 IRC Product: SIMATIC NET CP 1542SP-1 Product: SIMATIC NET CP 1542SP-1 IRC (incl.'SIPLUS variants) Product: SIMATIC NET CP 1543-1 (incl.'SIPLUS variants) Product: SIMATIC NET CP 1543SP-1 (incl.'SIPLUS variants) Product: SIMATIC RF185C Product: SIMATIC RF186C Product: SIMATIC RF186CI Product: SIMATIC RF188C Product: SIMATIC RF188CI Product: SINEMA Remote Connect Server

Vulnerabilities 2

  • Unscored —
    CVE-2018-5390 EPSS 72%

    Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service

    Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service.

    Linux linux_kernel linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Unscored —
    CVE-2018-5391 Public exploit EPSS 32%

    The Linux kernel, versions 3.9+, IP implementation is vulnerable to denial of service conditions with low rates of specially modified packets

    The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various…

    Linux kernel linux-raspi2 linux-hwe Linux Debian Ubuntu

Revision history

  1. #3

    Added solution for SIMATIC RF18xC/CI

  2. #2

    Removed IE/PB-Link V3 from affected products

  3. #1

    Publication Date

References