ICSA-23-047-10

icsaUScisa_csaf_ot

Siemens COMOS

view advisory published 2023-02-14

COMOS is affected by memory corruption vulnerability in the cache validation service that could allow an attacker to execute arbitrary code or cause denial of service condition. Siemens has released updates for the affected products and recommends to update to the latest versions.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2023-24482UScritical9.8—
A vulnerability has been identified in COMOS V10.2 (All versions), COMOS V10.3.3.1 (All versions < V10.3.3.1.45), COMOS V10.3.3.2 (All versions < V10.3.3.2.33), COMOS V10.3.3.3 (Al…
02

references

External citations — patches, advisories, analysis.

03

remediations (16)

  • MitigationCOMOS V10.2

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.3.3.1

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.3.3.2

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.3.3.3

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.3.3.4

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.4.0.0

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.4.1.0

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • MitigationCOMOS V10.4.2.0

    Enable Structured Exception Handling Overwrite Protection (SEHOP) in your Windows Operating System where COMOS is installed to protect against code execution. However, the application is still vulnerable to denial of service attacks

  • No fix plannedCOMOS V10.2

    Currently no fix is planned

  • FixedCOMOS V10.3.3.1

    Update to V10.3.3.1.45 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
  • FixedCOMOS V10.3.3.2

    Update to V10.3.3.2.33 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
  • FixedCOMOS V10.3.3.3

    Update to V10.3.3.3.9 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
  • FixedCOMOS V10.3.3.4

    Update to V10.3.3.4.6 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
  • FixedCOMOS V10.4.0.0

    Update to V10.4.0.0.31 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
  • FixedCOMOS V10.4.1.0

    Update to V10.4.1.0.32 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
  • FixedCOMOS V10.4.2.0

    Update to V10.4.2.0.25 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109815702/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan