Siemens Industrial Devices using libcurl
Vulnerabilities in third-party component cURL could allow an attacker to interfere with the affected products in various ways. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where updates are not, or not yet available.
describes (2)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-22924US | low3.7 | Exploit | ||
libcurl keeps previously used connections in a connection pool for subsequenttransfers to reuse, if one of them matches the setup.Due to errors in the logic, the config matching fu… | ||||
| CVE-2021-22901US | high8.1 | — | ||
curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malic… | ||||
references
External citations — patches, advisories, analysis.
- SSA-732250: Libcurl Vulnerabilities in Industrial Devices - CSAF Versionself
- SSA-732250: Libcurl Vulnerabilities in Industrial Devices - PDF Versionself
- SSA-732250: Libcurl Vulnerabilities in Industrial Devices - TXT Versionself
- ICS Advisory ICSA-22-132-13 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-132-13 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (46)
- MitigationLOGO! CMR family
Use the certificate projection feature to pin the valid certificates of external servers providing the services E-mail and DynDNS to the affected devices. To do this, see the description in the sections "Ca Certificate" in the chapters "E-Mail" and "DynDNS" in the manual
- No fix plannedLOGO! CMR family
Currently no fix is planned
- FixedRUGGEDCOM RM1224 LTE(4G) EU
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedRUGGEDCOM RM1224 LTE(4G) NAM
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M804PB
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M812-1 ADSL-Router (Annex A)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M812-1 ADSL-Router (Annex B)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M816-1 ADSL-Router (Annex A)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M816-1 ADSL-Router (Annex B)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M826-2 SHDSL-Router
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M874-2
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M874-3
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M876-3 (EVDO)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M876-3 (ROK)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M876-4 (EU)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE M876-4 (NAM)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE MUM856-1 (EU)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE MUM856-1 (RoW)
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSCALANCE S615
Update to V7.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807276 - FixedSIMATIC CP 1242-7 V2
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1242-7 V2
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-1
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-1
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-7 LTE EU
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-7 LTE EU
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-7 LTE US
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-7 LTE US
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-8 IRC
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1243-8 IRC
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIMATIC CP 1543-1
Update to V3.0.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808678 - FixedSIMATIC CP 1543-1
Update to V3.0.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808678 - FixedSIMATIC CP 1545-1
Update to V1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811116/ - FixedSIMATIC CP 1545-1
Update to V1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811116/ - FixedSIMATIC RTU3010C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3030C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3031C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSIMATIC RTU3041C
Update to V5.0.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109810215/ - FixedSINEMA Remote Connect Client
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811169/ - FixedSIPLUS NET CP 1242-7 V2
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIPLUS NET CP 1242-7 V2
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIPLUS NET CP 1543-1
Update to V3.0.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808678 - FixedSIPLUS NET CP 1543-1
Update to V3.0.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109808678 - FixedSIPLUS S7-1200 CP 1243-1
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIPLUS S7-1200 CP 1243-1
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIPLUS S7-1200 CP 1243-1 RAIL
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218 - FixedSIPLUS S7-1200 CP 1243-1 RAIL
Update to V3.3.46 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812218
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan