Summary
SIMATIC RF160B contain multiple vulnerabilities of different types that could allow an attacker to execute arbitrary code within the context of a privileged process.
Siemens has released a new version for SIMATIC RF160B and recommends to update to the latest version.
Vulnerabilities 157
-
Medium 6.4CVE-2021-0920 Exploited
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to loc…
KEV May 23, 2022 -
Critical 9.8
Possible buffer overflow due to improper validation of device types during P2P search in Snapdragon Auto, Snapdragon Co…
-
Critical 9.8
A use after free can occur due to improper validation of P2P device address in PD Request frame in Snapdragon Auto, Sna…
-
Critical 9.8
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …
-
Critical 9.8CVE-2022-20473 Public exploit
In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This …
-
Critical 9.1CVE-2020-11301 EPSS 11%
Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosu…
-
High 8.8
In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
High 8.8
In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check. This c…
-
High 7.8CVE-2020-14381 Public exploit
A flaw was found in the Linux kernel’s futex implementation. This flaw allows a local attacker to corrupt system memory…
-
High 7.8
In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check.…
-
High 7.5
Square OkHttp can accept the wrong certificate
In verifyHostName of OkHostnameVerifier.java, there is a possible way to accept a certificate for the wrong domain due to improperly used crypto. This could lead to remote information disclosure with no additional execution privileges needed. User interaction…
-
High 7.5
In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds re…
-
Medium 6.5
In BNEP_ConnectResp of bnep_api.cc, there is a possible out of bounds read due to an incorrect bounds check. This could…
-
Medium 5.5
A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect br…
-
Medium 5.5
In verifyBufferObject of Parcel.cpp, there is a possible out of bounds read due to an improper input validation. This c…
-
Medium 5.5
In getAvailableSubscriptionInfoList of SubscriptionController.java, there is a possible disclosure of unique identifier…
-
Medium 5.5
In onResume of VoicemailSettingsFragment.java, there is a possible way to retrieve a trackable identifier without permi…
-
Medium 5.5
In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's pass…
-
Medium 5.5
In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due…
-
Medium 5.5
In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead…
-
Medium 4.4
In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This c…
-
Unscored —
Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execu…
-
Unscored —
An issue was discovered in net/ipv6/ip6mr.c in the Linux kernel before 4.11. By setting a specific socket option, an at…
-
Unscored —
In checkKeyIntent of AccountManagerService.java, there is a possible permission bypass. This could lead to local inform…
-
Unscored —
In setNiNotification of GpsNetInitiatedHandler.java, there is a possible permissions bypass due to an empty mutable Pen…
-
Unscored —
An out-of-bounds memory write flaw was found in how the Linux kernel’s Voice Over IP H.323 connection tracking function…
-
Unscored —CVE-2020-15436 Public exploit
Use-after-free vulnerability in fs/block_dev.c in the Linux kernel before 5.8 allows local users to gain privileges or …
-
Unscored —
The 802.11 standard that underpins Wi-Fi Protected Access (WPA, WPA2, and WPA3) and Wired Equivalent Privacy (WEP) does…
-
Unscored —CVE-2020-25705 Public exploit
A flaw in ICMP packets in the Linux kernel may allow an attacker to quickly scan open UDP ports. This flaw allows an of…
-
Unscored —
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated…
-
Unscored —
Bluetooth LE and BR/EDR secure pairing in Bluetooth Core Specification 2.1 through 5.2 may permit a nearby man-in-the-m…
-
Unscored —
A locking inconsistency issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_i…
-
Unscored —CVE-2020-29661 Public exploit
A locking issue was discovered in the tty subsystem of the Linux kernel through 5.9.13. drivers/tty/tty_jobctrl.c allow…
-
Unscored —CVE-2021-0302 Public exploit
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —
In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local e…
-
Unscored —CVE-2021-0325 Public exploit
In ih264d_parse_pslice of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer overflow.…
-
Unscored —CVE-2021-0326 Public exploit
In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lea…
-
Unscored —CVE-2021-0327 Public exploit
In getContentProviderImpl of ActivityManagerService.java, there is a possible permission bypass due to non-restored bin…
-
Unscored —CVE-2021-0328 Public exploit
In onBatchScanReports and deliverBatchScan of GattService.java, there is a possible way to retrieve Bluetooth scan resu…
-
Unscored —CVE-2021-0329 Public exploit
In several native functions called by AdvertiseManager.java, there is a possible out of bounds write due to a missing b…
-
Unscored —CVE-2021-0330 Public exploit
In add_user_ce and remove_user_ce of storaged.cpp, there is a possible use-after-free due to improper locking. This cou…
-
Unscored —CVE-2021-0331 Public exploit
In onCreate of NotificationAccessConfirmationActivity.java, there is a possible overlay attack due to an insecure defau…
-
Unscored —CVE-2021-0333 Public exploit
In onCreate of BluetoothPermissionActivity.java, there is a possible permissions bypass due to a tapjacking overlay tha…
-
Unscored —CVE-2021-0334 Public exploit
In onTargetSelected of ResolverActivity.java, there is a possible settings bypass allowing an app to become the default…
-
Unscored —CVE-2021-0336 Public exploit
In onReceive of BluetoothPermissionRequest.java, there is a possible permissions bypass due to a mutable PendingIntent.…
-
Unscored —CVE-2021-0337 Public exploit
In moveInMediaStore of FileSystemProvider.java, there is a possible file exposure due to stale metadata. This could lea…
-
Unscored —CVE-2021-0339 Public exploit
In loadAnimation of WindowContainer.java, there is a possible way to keep displaying a malicious app while a target app…
-
Unscored —CVE-2021-0390 Public exploit
In various methods of WifiNetworkSuggestionsManager.java, there is a possible modification of suggested networks due to…
-
Unscored —CVE-2021-0391 Public exploit
In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, witho…
-
Unscored —CVE-2021-0392 Public exploit
In main of main.cpp, there is a possible memory corruption due to a double free. This could lead to local escalation of…
-
Unscored —CVE-2021-0393 Public exploit
In Scanner::LiteralBuffer::NewCapacity of scanner.cc, there is a possible out of bounds write due to an integer overflo…
-
Unscored —CVE-2021-0394 Public exploit
In android_os_Parcel_readString8 of android_os_Parcel.cpp, there is a possible out of bounds read due to a missing boun…
-
Unscored —CVE-2021-0396 Public exploit
In Builtins::Generate_ArgumentsAdaptorTrampoline of builtins-arm.cc and related files, there is a possible out of bound…
-
Unscored —CVE-2021-0397 Public exploit
In sdp_copy_raw_data of sdp_discovery.cc, there is a possible system compromise due to a double free. This could lead t…
-
Unscored —CVE-2021-0399 Public exploit
In qtaguid_untag of xt_qtaguid.c, there is a possible memory corruption due to a use after free. This could lead to loc…
-
Unscored —
In injectBestLocation and handleUpdateLocation of GnssLocationProvider.java, there is a possible incorrect reporting of…
-
Unscored —
In pollOnce of ALooper.cpp, there is possible memory corruption due to a use after free. This could lead to local escal…
-
Unscored —CVE-2021-0431 Public exploit
In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead…
-
Unscored —CVE-2021-0433 Public exploit
In onCreate of DeviceChooserActivity.java, there is a possible way to bypass user consent when pairing a Bluetooth devi…
-
Unscored —
In onReceive of BluetoothPermissionRequest.java, there is a possible phishing attack allowing a malicious Bluetooth dev…
-
Unscored —CVE-2021-0435 Public exploit
In avrc_proc_vendor_command of avrc_api.cc, there is a possible leak of heap data due to uninitialized data. This could…
-
Unscored —
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds read due to integer overflow. This coul…
-
Unscored —CVE-2021-0437 Public exploit
In setPlayPolicy of DrmPlugin.cpp, there is a possible double free. This could lead to local escalation of privilege in…
-
Unscored —
In several functions of InputDispatcher.cpp, WindowManagerService.java, and related files, there is a possible tapjacki…
-
Unscored —
In several functions of ScreenshotHelper.java and related files, there is a possible incorrectly saved screenshot due t…
-
Unscored —
In onActivityResult of QuickContactActivity.java, there is an unnecessary return of an intent. This could lead to local…
-
Unscored —
In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to an integer overflow. This could lead …
-
Unscored —
In rw_t3t_process_error of rw_t3t.cc, there is a possible double free due to uninitialized data. This could lead to rem…
-
Unscored —CVE-2021-0474 Public exploit
In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lea…
-
Unscored —CVE-2021-0476 Public exploit
In FindOrCreatePeer of btif_av.cc, there is a possible use after free due to a race condition. This could lead to local…
-
Unscored —CVE-2021-0478 Public exploit
In updateDrawable of StatusBarIconView.java, there is a possible permission bypass due to an uncaught exception. This c…
-
Unscored —
In createPendingIntent of SnoozeHelper.java, there is a possible broadcast intent containing a sensitive identifier. Th…
-
Unscored —CVE-2021-0481 Public exploit
In onActivityResult of EditUserPhotoController.java, there is a possible access of unauthorized files due to an unexpec…
-
Unscored —
In readVector of IMediaPlayer.cpp, there is a possible read of uninitialized heap data due to a missing bounds check. T…
-
Unscored —CVE-2021-0506 Public exploit
In ActivityPicker.java, there is a possible bypass of user interaction in intent resolution due to a tapjacking/overlay…
-
Unscored —CVE-2021-0507 Public exploit
In handle_rc_metamsg_cmd of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check. This cou…
-
Unscored —CVE-2021-0508 Public exploit
In various functions of DrmPlugin.cpp, there is a possible use after free due to a race condition. This could lead to l…
-
Unscored —CVE-2021-0509 Public exploit
In various functions of CryptoPlugin.cpp, there is a possible use after free due to a race condition. This could lead t…
-
Unscored —CVE-2021-0510 Public exploit
In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds write due to an integer overflow. This could lead…
-
Unscored —CVE-2021-0511 Public exploit
In Dex2oat of dex2oat.cc, there is a possible way to inject bytecode into an app due to improper input validation. This…
-
Unscored —
In __hidinput_change_resolution_multipliers of hid-input.c, there is a possible out of bounds write due to a heap buffe…
-
Unscored —CVE-2021-0513 Public exploit
In deleteNotificationChannel and related functions of NotificationManagerService.java, there is a possible permission b…
-
Unscored —
In several functions of the V8 library, there is a possible use after free due to a race condition. This could lead to …
-
Unscored —
In Factory::CreateStrictFunctionMap of factory.cc, there is a possible out of bounds write due to an incorrect bounds c…
-
Unscored —CVE-2021-0516 Public exploit
In p2p_process_prov_disc_req of p2p_pd.c, there is a possible out of bounds read and write due to a use after free. Thi…
-
Unscored —CVE-2021-0519 Public exploit
In BITSTREAM_FLUSH of ih264e_bitstream.h, there is a possible out of bounds write due to a heap buffer overflow. This c…
-
Unscored —CVE-2021-0520 Public exploit
In several functions of MemoryFileSystem.cpp and related files, there is a possible use after free due to a race condit…
-
Unscored —
In getAllPackages of PackageManagerService, there is a possible information disclosure due to a missing permission chec…
-
Unscored —CVE-2021-0522 Public exploit
In ConnectionHandler::SdpCb of connection_handler.cc, there is a possible out of bounds read due to a use after free. T…
-
Unscored —
In beginWrite and beginRead of MessageQueueBase.h, there is a possible out of bounds write due to improper input valida…
-
Unscored —CVE-2021-0586 Public exploit
In onCreate of DevicePickerFragment.java, there is a possible way to trick the user to select an unwanted bluetooth dev…
-
Unscored —
In StreamOut::prepareForWriting of StreamOut.cpp, there is a possible out of bounds write due to a use after free. This…
-
Unscored —
In processInboundMessage of MceStateMachine.java, there is a possible SMS disclosure due to a missing permission check.…
-
Unscored —CVE-2021-0589 Public exploit
In BTM_TryAllocateSCN of btm_scn.cc, there is a possible out of bounds write due to an incorrect bounds check. This cou…
-
Unscored —
In sendReplyIntentToReceiver of BluetoothPermissionActivity.java, there is a possible way to invoke privileged broadcas…
-
Unscored —
In sendDevicePickedIntent of DevicePickerFragment.java, there is a possible way to invoke a privileged broadcast receiv…
-
Unscored —CVE-2021-0594 Public exploit
In onCreate of ConfirmConnectActivity, there is a possible remote bypass of user consent due to improper input validati…
-
Unscored —
In phNciNfc_RecvMfResp of phNxpExtns_MifareStd.cpp, there is a possible out of bounds read due to a missing bounds chec…
-
Unscored —
In notifyProfileAdded and notifyProfileRemoved of SipService.java, there is a possible way to retrieve SIP account name…
-
Unscored —
In onCreate of ConfirmConnectActivity.java, there is a possible pairing of untrusted Bluetooth devices due to a tapjack…
-
Unscored —
In scheduleTimeoutLocked of NotificationRecord.java, there is a possible disclosure of a sensitive identifier via broad…
-
Unscored —CVE-2021-0600 Public exploit
In onCreate of DeviceAdminAdd.java, there is a possible way to mislead a user to activate a device admin app due to imp…
-
Unscored —
In encodeFrames of avc_enc_fuzzer.cpp, there is a possible out of bounds write due to a double free. This could lead to…
-
Unscored —
In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible way to share private files over Bluetooth due…
-
Unscored —CVE-2021-0640 Public exploit
In noteAtomLogged of StatsdStats.cpp, there is a possible out of bounds write due to a missing bounds check. This could…
-
Unscored —
In sqlite3_str_vappendf of sqlite3.c, there is a possible out of bounds write due to improper input validation. This co…
-
Unscored —
In WT_InterpolateNoLoop of eas_wtengine.c, there is a possible out of bounds read due to an incorrect bounds check. Thi…
-
Unscored —
In loadLabel of PackageItemInfo.java, there is a possible way to DoS a device by having a long label in an app due to i…
-
Unscored —CVE-2021-0652 Public exploit
In VectorDrawable::VectorDrawable of VectorDrawable.java, there is a possible way to introduce a memory corruption due …
-
Unscored —
In enqueueNotification of NetworkPolicyManagerService.java, there is a possible way to retrieve a trackable identifier …
-
Unscored —
In sendAccessibilityEvent of NotificationManagerService.java, there is a possible disclosure of notification data due t…
-
Unscored —CVE-2021-0683 Public exploit
In runTraceIpcStop of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused …
-
Unscored —
In TouchInputMapper::sync of TouchInputMapper.cpp, there is a possible out of bounds write due to a use after free. Thi…
-
Unscored —
In ellipsize of Layout.java, there is a possible ANR due to improper input validation. This could lead to local denial …
-
Unscored —CVE-2021-0688 Public exploit
In lockNow of PhoneWindowManager.java, there is a possible lock screen bypass due to a race condition. This could lead …
-
Unscored —
In RGB_to_BGR1_portable of SkSwizzler_opts.h, there is a possible out of bounds read due to a missing bounds check. Thi…
-
Unscored —
In ih264d_mark_err_slice_skip of ih264d_parse_pslice.c, there is a possible out of bounds write due to a heap buffer ov…
-
Unscored —
In sendBroadcastToInstaller of FirstScreenBroadcast.java, there is a possible activity launch due to an unsafe PendingI…
-
Unscored —
In get_sock_stat of xt_qtaguid.c, there is a possible out of bounds read due to a use after free. This could lead to lo…
-
Unscored —
In createNoCredentialsPermissionNotification and related functions of AccountManagerService.java, there is a possible w…
-
Unscored —
In startListening of PluginManagerImpl.java, there is a possible way to disable arbitrary app components due to a missi…
-
Unscored —
In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused depu…
-
Unscored —
In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead t…
-
Unscored —
In getService of IServiceManager.cpp, there is a possible unhandled exception due to an integer overflow. This could le…
-
Unscored —
In onCreate of NfcImportVCardActivity.java, there is a possible way to add a contact without user's consent due to a mi…
-
Unscored —CVE-2021-0928 Public exploit
In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due …
-
Unscored —
In ion_dma_buf_end_cpu_access and related functions of ion.c, there is a possible way to corrupt memory due to a use af…
-
Unscored —
In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc, there is a possible out of bounds write due to a missing bounds c…
-
Unscored —
In getAlias of BluetoothDevice.java, there is a possible way to create misleading permission dialogs due to missing dat…
-
Unscored —
In onCreate of CompanionDeviceActivity.java or DeviceChooserActivity.java, there is a possible way for HTML tags to int…
-
Unscored —
In doCropPhoto of PhotoSelectionHandler.java, there is a possible permission bypass due to a confused deputy. This coul…
-
Unscored —
In setOnClickActivityIntent of SearchWidgetProvider.java, there is a possible way to access contacts and history bookma…
-
Unscored —
In quota_proc_write of xt_quota2.c, there is a possible way to read kernel memory due to uninitialized data. This could…
-
Unscored —CVE-2021-0963 Public exploit
In onCreate of KeyChainActivity.java, there is a possible way to use an app certificate stored in keychain due to a tap…
-
Unscored —
In C2SoftMP3::process() of C2SoftMp3Dec.cpp, there is a possible out of bounds write due to a heap buffer overflow. Thi…
-
Unscored —
In AndroidManifest.xml of Settings, there is a possible pairing of a Bluetooth device without user's consent due to a m…
-
Unscored —
In vorbis_book_decodev_set of codebook.c, there is a possible out of bounds write due to a missing bounds check. This c…
-
Unscored —
In osi_malloc and osi_calloc of allocator.cc, there is a possible out of bounds write due to an integer overflow. This …
-
Unscored —
In createFromParcel of GpsNavigationMessage.java, there is a possible Parcel serialization/deserialization mismatch. Th…
-
Unscored —
An issue was discovered in the Linux kernel before 5.11.11. qrtr_recvmsg in net/qrtr/qrtr.c allows attackers to obtain …
-
Unscored —CVE-2021-33909 Public exploit
fs/seq_file.c in the Linux kernel 3.16 through 5.13.x before 5.13.4 does not properly restrict seq buffer allocations, …
-
Unscored —
drivers/usb/host/max3421-hcd.c in the Linux kernel before 5.13.6 allows physically proximate attackers to cause a denia…
-
Unscored —
In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsaf…
-
Unscored —
In doRead of SimpleDecodingSource.cpp, there is a possible out of bounds write due to an incorrect bounds check. This c…
-
Unscored —
In onAttach of ConnectedDeviceDashboardFragment.java, there is a possible permission bypass due to a confused deputy. T…
-
Unscored —
In sendLegacyVoicemailNotification of LegacyModeSmsHandler.java, there is a possible permissions bypass due to an unsaf…
-
Unscored —
In phTmlNfc_Init and phTmlNfc_CleanUp of phTmlNfc.cc, there is a possible use after free due to a race condition. This …
-
Unscored —
In gre_handle_offloads of ip_gre.c, there is a possible page fault due to an invalid memory access. This could lead to …
-
Unscored —
In fs/eventpoll.c, there is a possible use after free. This could lead to local escalation of privilege with no additio…
-
Unscored —
In ce_t4t_data_cback of ce_t4t.cc, there is a possible out of bounds write due to a double free. This could lead to rem…
-
Unscored —CVE-2022-20130 Public exploit
In transportDec_OutOfBandConfig of tpdec_lib.cpp, there is a possible out of bounds write due to a heap buffer overflow…
-
Unscored —
In USB driver, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local informati…
-
Unscored —CVE-2022-20229 Public exploit
In bta_hf_client_handle_cind_list_item of bta_hf_client_at.cc, there is a possible out of bounds write due to a missing…
-
Unscored —
In get of PacProxyService.java, there is a possible system service crash due to improper input validation. This could l…
-
Unscored —CVE-2022-20421 Public exploit
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could l…
-
Unscored —
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. Thi…
-
Unscored —
In rndis_set_response of rndis.c, there is a possible out of bounds write due to an integer overflow. This could lead t…
Revision history
-
#1
Publication Date
References
-
SSA-770721: Multiple Vulnerabilities in SIMATIC RF160B before V2.2 - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-770721.html
-
SSA-770721: Multiple Vulnerabilities in SIMATIC RF160B before V2.2 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-770721.pdf
-
SSA-770721: Multiple Vulnerabilities in SIMATIC RF160B before V2.2 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-770721.txt