Vulnerability · Published Apr 12, 2022 · Assigned by siemens

CVE-2022-28329

Medium 6.5

In plain English

A medium-severity improper input validation in SCALANCE W1788-1 M12 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS NVD)6.5Medium

Exploit odds (30 days)0.4%top 69.1% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle malformed TCP packets received over the RemoteCapture feature. This could allow an attacker to lead to a denial of service condition which only affects the port used by the RemoteCapture feature.

Affected products (as reported)

Vendor	Product	Versions
Siemens	SCALANCE W1788-1 M12	All versions < V3.0.0
Siemens	SCALANCE W1788-2 EEC M12	All versions < V3.0.0
Siemens	SCALANCE W1788-2 M12	All versions < V3.0.0
Siemens	SCALANCE W1788-2IA M12	All versions < V3.0.0

Weakness: CWE-20

References

https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf x_refsource_MISC