Summary
SIMATIC MV500 devices before V3.3.4 are affected by multiple vulnerabilities in the web server and several third-party components.
Siemens has released updates for the affected products and recommends to update to the latest versions.
Vulnerabilities 13
-
Critical 9.8
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip heade…
-
High 8.6
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4)…
-
High 7.5
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc becaus…
-
High 7.5CVE-2022-36946 Public exploit
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a …
-
High 7.5CVE-2022-4450 EPSS 29%
Double free after calling PEM_read_bio_ex
The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload data. If the function succeeds then the "name_out", "header" and "data" arguments are populated with pointers to…
-
High 7.5
Use-after-free following BIO_new_NDEF
The public API function BIO_new_NDEF is a helper function used for streaming ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support the SMIME, CMS and PKCS7 streaming capabilities, but may also be called directly by end user applications.…
-
High 7.5
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4)…
-
High 7.5
A vulnerability has been identified in SIMATIC MV540 H (All versions < V3.3.4), SIMATIC MV540 S (All versions < V3.3.4)…
-
High 7.4
X.400 address type confusion in X.509 GeneralName
There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but the public structure definition for GENERAL_NAME incorrectly specified the type of the x400Address fiel…
-
High 7.3
JSZip contains Path Traversal via loadAsync
loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive.
-
Medium 5.9
Timing Oracle in RSA Decryption
A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a …
-
Unscored —
A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table pe…
-
Unscored —
nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a fa…
Revision history
-
#1
Publication Date
References
-
SSA-561322: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3.4 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-561322.html
-
SSA-561322: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3.4 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-561322.pdf
-
SSA-561322: Multiple Vulnerabilities in SIMATIC MV500 Devices before V3.3.4 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-561322.txt