Critical SSA-506569 13 CVEs

SSA-506569: Multiple Vulnerabilities in SCALANCE W1750D

Published Nov 8, 2022 · Updated Feb 14, 2023 · Revision 2

Vendor: Siemens Product: SCALANCE W1750D (JP) (6GK5750-2HX01-1AD0) Product: SCALANCE W1750D (ROW) (6GK5750-2HX01-1AA0) Product: SCALANCE W1750D (USA) (6GK5750-2HX01-1AB0)

Summary

The SCALANCE W1750D device contains multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to denial of service, unauthenticated remote code execution or stored XSS.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 13

Unscored —

CVE-2002-20001 Public exploit EPSS 25%

The Diffie-Hellman Key Agreement Protocol allows remote attackers (from the client side) to send arbitrary numbers that…

Nov 11, 2021
Unscored —

CVE-2022-37885

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote cod…

Oct 7, 2022
Unscored —

CVE-2022-37886

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote cod…

Oct 7, 2022
Unscored —

CVE-2022-37887

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote cod…

Oct 7, 2022
Unscored —

CVE-2022-37888

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote cod…

Oct 6, 2022
Unscored —

CVE-2022-37889

There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote cod…

Oct 7, 2022
Unscored —

CVE-2022-37890

Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interfac…

Oct 7, 2022
Unscored —

CVE-2022-37891

Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interfac…

Oct 7, 2022
Unscored —

CVE-2022-37892

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote at…

Oct 7, 2022
Unscored —

CVE-2022-37893

An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. S…

Oct 7, 2022
Unscored —

CVE-2022-37894

An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba Instan…

Oct 7, 2022
Unscored —

CVE-2022-37895

An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba Instan…

Oct 7, 2022
Unscored —

CVE-2022-37896

A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct…

Oct 7, 2022

Revision history

2023-02-14 #2
Added fix for SCALANCE W1750D
2022-11-08 #1
Publication Date

References

SSA-506569: Multiple Vulnerabilities in SCALANCE W1750D - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-506569.pdf
SSA-506569: Multiple Vulnerabilities in SCALANCE W1750D - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-506569.txt