Skip to content
OpenAdvisories
Critical ICSA-22-228-04 9 CVEs

Softing Secure Integration Server

Published Aug 16, 2022 · Updated Aug 16, 2022

Vendor: Softing Product: edgeAggregator Product: edgeConnector Product: OPC Suite Product: OPC UA C++ Server SDK Product: Secure Integration Server Product: uaGate

Summary

Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.

Vulnerabilities 9

  • Critical 9.8
    CVE-2022-2336

    Softing Secure Integration Server Improper Authentication

    Softing Secure Integration Server, edgeConnector, and edgeAggregator software ships with the default administrator credentials as `admin` and password as `admin`. This allows Softing to log in to the server directly to perform administrative functions. Upon i…

    Softing Secure Integration Server edgeAggregator edgeConnector Siemens
  • High 7.5
    CVE-2022-1069

    Softing Secure Integration Server Out-of-bounds Read

    A crafted HTTP packet with a large content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.

    Softing Secure Integration Server
  • High 7.5
    CVE-2022-1748

    Softing Secure Integration Server NULL Pointer Dereference

    Softing OPC UA C++ Server SDK, Secure Integration Server, edgeConnector, edgeAggregator, OPC Suite, and uaGate are affected by a NULL pointer dereference vulnerability.

    Softing Secure Integration Server edgeAggregator edgeConnector Siemens
  • High 7.5
    CVE-2022-2335

    Softing Secure Integration Server Integer Underflow

    A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.

    Softing Secure Integration Server
  • High 7.5
    CVE-2022-2337

    Softing Secure Integration Server NULL Pointer Dereference

    A crafted HTTP packet with a missing HTTP URI can create a denial-of-service condition in Softing Secure Integration Server V1.22.

    Softing Secure Integration Server
  • High 7.5
    CVE-2022-2547

    Softing Secure Integration Server NULL Pointer Dereference

    A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22.

    Softing Secure Integration Server
  • High 7.2
    CVE-2022-1373 Public exploit EPSS 13%

    Softing Secure Integration Server Relative Path Traversal

    The “restore configuration” feature of Softing Secure Integration Server V1.22 is vulnerable to a directory traversal vulnerability when processing zip files. An attacker can craft a zip file to load an arbitrary dll and execute code. Using the "restore confi…

    Softing Secure Integration Server
  • High 7.2
    CVE-2022-2334 Public exploit EPSS 12%

    Softing Secure Integration Server Uncontrolled Search Path Element

    The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.

    Softing Secure Integration Server
  • Medium 5.7
    CVE-2022-2338

    Softing Secure Integration Server Cleartext Transmission of Sensitive Information

    Softing Secure Integration Server V1.22 is vulnerable to authentication bypass via a machine-in-the-middle attack. The default the administration interface is accessible via plaintext HTTP protocol, facilitating the attack. The HTTP request may contain the se…

    Softing Secure Integration Server

Revision history

  1. #1

    Publication Date

References