Summary
Siemens has released a new version for SINEC INS that fixes multiple vulnerabilities that could allow an attacker to read and write arbitrary files from the file system of the affected component and to ultimately execute arbitrary code on the device. In addition, this version also contains fixes for multiple vulnerabilities in underlying third party components.
Siemens has released an update for SINEC INS and recommends to update to the latest version.
Vulnerabilities 12
-
Critical 9.9CVE-2022-45092 EPSS 31%
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker w…
-
Critical 9.8CVE-2022-2068 EPSS 96%
The c_rehash script allows command injection
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was…
-
Critical 9.8
RSA implementation bug in AVX512IFMA instructions
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 2048 bit private keys incorrect on such machines and memory corruption will happe…
-
Critical 9.1CVE-2022-32213 EPSS 45%
llhttp allows HTTP Request Smuggling via Flawed Parsing of Transfer-Encoding
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smuggling (HRS).
-
Critical 9.1
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in Secret…
-
High 8.5
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker w…
-
High 8.4
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker w…
-
High 7.5CVE-2022-2097 Public exploit
AES OCB fails to encrypt some bytes
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the…
-
Medium 6.5
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated wi…
-
Unscored —
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAl…
-
Unscored —CVE-2022-32215 EPSS 70%
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line …
-
Unscored —
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default p…
Revision history
-
#1
Publication Date
References
-
SSA-332410: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 1 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
-
SSA-332410: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 1 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-332410.txt