ID

VAR-202206-1187


CVE

CVE-2022-30937


TITLE

Siemens EN100 Ethernet module Buffer error vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-202206-1258

DESCRIPTION

A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.37), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint. This could allow an attacker to crash the affected application leading to a denial of service condition

Trust: 0.99

sources: NVD: CVE-2022-30937 // VULMON: CVE-2022-30937

AFFECTED PRODUCTS

vendor:siemensmodel:en100 ethernet module modbus tcpscope:eqversion: -

Trust: 1.0

vendor:siemensmodel:en100 ethernet module iec 61850scope:ltversion:4.37

Trust: 1.0

vendor:siemensmodel:en100 ethernet module iec 104scope:eqversion: -

Trust: 1.0

vendor:siemensmodel:en100 ethernet module profinet ioscope:eqversion: -

Trust: 1.0

vendor:siemensmodel:en100 ethernet module dnp3scope:eqversion: -

Trust: 1.0

sources: NVD: CVE-2022-30937

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2022-30937
value: HIGH

Trust: 1.0

CNNVD: CNNVD-202206-1258
value: HIGH

Trust: 0.6

NVD:
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:N/I:N/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

NVD:
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: NVD: CVE-2022-30937 // CNNVD: CNNVD-202206-1258

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2022-30937

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202206-1258

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202206-1258

CONFIGURATIONS

sources: NVD: CVE-2022-30937

PATCH

title:Siemens EN100 Ethernet module Buffer error vulnerability fixurl:http://123.124.177.30/web/xxk/bdxqbyid.tag?id=196607

Trust: 0.6

sources: CNNVD: CNNVD-202206-1258

EXTERNAL IDS

db:SIEMENSid:SSA-693555

Trust: 1.7

db:NVDid:CVE-2022-30937

Trust: 1.7

db:ICS CERTid:ICSA-22-167-05

Trust: 0.7

db:AUSCERTid:ESB-2022.2995

Trust: 0.6

db:CNNVDid:CNNVD-202206-1258

Trust: 0.6

db:VULMONid:CVE-2022-30937

Trust: 0.1

sources: VULMON: CVE-2022-30937 // NVD: CVE-2022-30937 // CNNVD: CNNVD-202206-1258

REFERENCES

url:https://cert-portal.siemens.com/productcert/pdf/ssa-693555.pdf

Trust: 1.7

url:https://us-cert.cisa.gov/ics/advisories/icsa-22-167-05

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-30937/

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.2995

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

url:https://www.cisa.gov/uscert/ics/advisories/icsa-22-167-05

Trust: 0.1

sources: VULMON: CVE-2022-30937 // NVD: CVE-2022-30937 // CNNVD: CNNVD-202206-1258

CREDITS

Michael Messner from Siemens Energy reported this vulnerability to Siemens.

Trust: 0.6

sources: CNNVD: CNNVD-202206-1258

SOURCES

db:VULMONid:CVE-2022-30937
db:NVDid:CVE-2022-30937
db:CNNVDid:CNNVD-202206-1258

LAST UPDATE DATE

2023-12-18T12:34:23.856000+00:00


SOURCES UPDATE DATE

db:VULMONid:CVE-2022-30937date:2022-06-14T00:00:00
db:NVDid:CVE-2022-30937date:2023-06-29T14:29:15.110
db:CNNVDid:CNNVD-202206-1258date:2023-06-30T00:00:00

SOURCES RELEASE DATE

db:VULMONid:CVE-2022-30937date:2022-06-14T00:00:00
db:NVDid:CVE-2022-30937date:2022-06-14T10:15:20.490
db:CNNVDid:CNNVD-202206-1258date:2022-06-14T00:00:00