High ICSA-22-349-18 4 CVEs

Siemens SCALANCE SC-600 Family

Published Dec 13, 2022 · Updated Dec 13, 2022

Vendor: Siemens Product: SCALANCE SC622-2C (6GK5622-2GS00-2AC2) Product: SCALANCE SC626-2C (6GK5626-2GS00-2AC2) Product: SCALANCE SC632-2C (6GK5632-2GS00-2AC2) Product: SCALANCE SC636-2C (6GK5636-2GS00-2AC2) Product: SCALANCE SC642-2C (6GK5642-2GS00-2AC2) Product: SCALANCE SC646-2C (6GK5646-2GS00-2AC2)

Summary

Multiple vulnerabilities affecting various third-party components of the SCALANCE SC-600 family could allow an attacker to cause a denial of service condition, corrupt memory or potentially execute custom code.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 4

High 7.8

CVE-2022-30065

A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing …

busybox busybox busybox busybox Debian Azure Linux Alpine Wolfi

May 18, 2022
High 7.5

CVE-2018-25032 Public exploit EPSS 52%

Nokogiri affected by zlib's Out-of-bounds Write vulnerability

zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

mariadb-10.3 mariadb-10.6 mariadb openjpeg2 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems

Mar 25, 2022
Medium 6.5

CVE-2022-32206 EPSS 36%

curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple …

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022
Medium 4.3

CVE-2022-32205 EPSS 31%

A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 st…

curl curl curl curl Debian Ubuntu Azure Linux Alpine

Jul 7, 2022

Revision history

2022-12-13 #1
Publication Date

References

SSA-333517: Multiple Vulnerabilities in SCALANCE SC-600 Family before V3.0 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-333517.txt
SSA-333517: Multiple Vulnerabilities in SCALANCE SC-600 Family before V3.0 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf
ICS Advisory ICSA-22-349-18 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-349-18
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B