Sign-up

ID

VAR-202210-0430


CVE

CVE-2022-31766


TITLE

Siemens RUGGEDCOM RM1224 Input validation error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202210-395

DESCRIPTION

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V7.1.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V7.1.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V7.1.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V7.1.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V7.1.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V7.1.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V7.1.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V7.1.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V7.1.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V7.1.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V7.1.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V7.1.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V7.1.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V7.1.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V7.1.2), SCALANCE WAM763-1 (6GK5763-1AL00-7DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 (6GK5766-1GE00-7DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 (US) (6GK5766-1GE00-7DB0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 EEC (6GK5766-1GE00-7TA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WAM766-1 EEC (US) (6GK5766-1GE00-7TB0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3AA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM763-1 (6GK5763-1AL00-3DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM766-1 (6GK5766-1GE00-3DA0) (All versions >= V1.1.0 < V3.0.0), SCALANCE WUM766-1 (USA) (6GK5766-1GE00-3DB0) (All versions >= V1.1.0 < V3.0.0). Affected devices with TCP Event service enabled do not properly handle malformed packets. This could allow an unauthenticated remote attacker to cause a denial of service condition and reboot the device thus possibly affecting other network resources.

Trust: 1.0

sources: NVD: CVE-2022-31766

IOT TAXONOMY

category:['network device']sub_category:router

Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:siemensmodel:scalance wam763-1scope:gteversion:1.1.0

Trust: 1.0

vendor:siemensmodel:scalance m874-2scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:ruggedcom rm1224scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance m804pbscope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance m876-3scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance mum856-1scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance m876-4scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance wum763-1scope:gteversion:1.1.0

Trust: 1.0

vendor:siemensmodel:scalance wum766-1scope:gteversion:1.1.0

Trust: 1.0

vendor:siemensmodel:scalance m826-2scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance wam766-1scope:gteversion:1.1.0

Trust: 1.0

vendor:siemensmodel:scalance m874-3scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance mum853-1scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance m812-1scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance s615scope:ltversion:7.1.2

Trust: 1.0

vendor:siemensmodel:scalance m816-1scope:ltversion:7.1.2

Trust: 1.0

sources: NVD: CVE-2022-31766

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com: CVE-2022-31766
value: HIGH

Trust: 1.0

nvd@nist.gov: CVE-2022-31766
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202210-395
value: HIGH

Trust: 0.6

productcert@siemens.com: CVE-2022-31766
baseSeverity: HIGH
baseScore: 8.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.0
version: 3.1

Trust: 2.0

sources: CNNVD: CNNVD-202210-395 // NVD: CVE-2022-31766 // NVD: CVE-2022-31766

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.0

sources: NVD: CVE-2022-31766

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202210-395

TYPE

input validation error

Trust: 0.6

sources: CNNVD: CNNVD-202210-395

PATCH

title:Siemens RUGGEDCOM RM1224 Enter the fix for the verification error vulnerabilityurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=210522

Trust: 0.6

sources: CNNVD: CNNVD-202210-395

EXTERNAL IDS

db:NVDid:CVE-2022-31766

Trust: 1.7

db:SIEMENSid:SSA-697140

Trust: 1.6

db:ICS CERTid:ICSA-22-286-08

Trust: 0.6

db:AUSCERTid:ESB-2022.5100

Trust: 0.6

db:CNNVDid:CNNVD-202210-395

Trust: 0.6

db:OTHERid:NONE

Trust: 0.1

sources: OTHER: None // CNNVD: CNNVD-202210-395 // NVD: CVE-2022-31766

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf

Trust: 1.6

url:https://cert-portal.siemens.com/productcert/html/ssa-697140.html

Trust: 1.0

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-286-08

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.5100

Trust: 0.6

url:https://vigilance.fr/vulnerability/ruggedcom-rm1224-denial-of-service-via-tcp-event-service-39512

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-31766/

Trust: 0.6

url:https://ieeexplore.ieee.org/abstract/document/10769424

Trust: 0.1

sources: OTHER: None // CNNVD: CNNVD-202210-395 // NVD: CVE-2022-31766

CREDITS

Martin Grubhofer and Michael Messner of Siemens Energy reported this vulnerability to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202210-395

SOURCES

db:OTHERid: -
db:CNNVDid:CNNVD-202210-395
db:NVDid:CVE-2022-31766

LAST UPDATE DATE

2025-02-11T21:47:50.512000+00:00


SOURCES UPDATE DATE

db:CNNVDid:CNNVD-202210-395date:2023-03-15T00:00:00
db:NVDid:CVE-2022-31766date:2025-02-11T11:15:11.210

SOURCES RELEASE DATE

db:CNNVDid:CNNVD-202210-395date:2022-10-11T00:00:00
db:NVDid:CVE-2022-31766date:2022-10-11T11:15:09.810