Vulnerability · Published May 10, 2022 · Assigned by siemens
CVE-2022-27640
Medium 6.5
In plain English
A medium-severity uncontrolled resource consumption in SIMATIC CP 442-1 RNA from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions < V1.5.18), SIMATIC CP 443-1 RNA (All versions < V1.5.18). The affected devices improperly handles excessive ARP broadcast requests. This could allow an attacker to create a denial of service condition by performing ARP storming attacks, which can cause the device to reboot.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC CP 442-1 RNA | All versions < V1.5.18 |
| Siemens | SIMATIC CP 443-1 RNA | All versions < V1.5.18 |
Weakness: CWE-400
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-480937.pdf x_refsource_MISC