Summary
Nozomi Networks has published information on vulnerabilities in
Nozomi Guardian/CMC before 23.4.1. This advisory lists the related Siemens Industrial products affected by these vulnerabilities.
Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Customers are advised to consult and implement the workarounds provided in Nozomi Network's upstream security notifications.
Vulnerabilities 2
-
High 7.5
DoS on IDS parsing of malformed Radius packets in Guardian before 23.4.1
A Denial of Service (Dos) vulnerability in Nozomi Networks Guardian, caused by improper input validation in certain fields used in the Radius parsing functionality of our IDS, allows an unauthenticated attacker sending specially crafted malformed network pack…
-
High 7.2
Information disclosure via audit records for OpenAPI requests in Guardian/CMC before 23.4.1
Audit records for OpenAPI requests may include sensitive information. This could lead to unauthorized accesses and privilege escalation.
Revision history
-
#1
Publication Date
References
-
SSA-292022: Vulnerability in Nozomi Guardian/CMC before 23.4.1 on RUGGEDCOM APE1808 devices - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-292022.html
-
SSA-292022: Vulnerability in Nozomi Guardian/CMC before 23.4.1 on RUGGEDCOM APE1808 devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-292022.pdf
-
SSA-292022: Vulnerability in Nozomi Guardian/CMC before 23.4.1 on RUGGEDCOM APE1808 devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-292022.txt