Siemens SINAMICS Medium Voltage Products
SINAMICS PERFECT HARMONY GH180 is affected by multiple vulnerabilities in the integrated SCALANCE S615 device, as documented in SSA-419740 ( https://cert-portal.siemens.com/productcert/html/ssa-419740.html). Siemens recommends to update the firmware of the integrated SCALANCE S615 device to the latest version. Siemens recommends specific countermeasures for products where the firmware update is not, or not yet applied. Additional considerations regarding the specific impact of the vulnerabilities to SINAMICS MV products can be found in the chapter "Additional Information".
describes (23)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-35252US | low3.7 | — | ||
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server ret… | ||||
| CVE-2022-1199US | high7.5 | — | ||
A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerab… | ||||
| CVE-2022-36946US | high7.5 | Exploit | ||
nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue… | ||||
| CVE-2022-32208US | medium5.9 | — | ||
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed… | ||||
| CVE-2022-32207US | critical9.8OT elevated | — | ||
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final t… | ||||
| CVE-2022-32206US | medium6.5 | — | ||
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number o… | ||||
| CVE-2022-32205US | medium4.3 | — | ||
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookie… | ||||
| CVE-2022-1473US | high7.5 | — | ||
The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries. This function is used when… | ||||
| CVE-2022-1343US | medium5.3 | — | ||
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be posit… | ||||
| CVE-2022-1292US | high7.3 | Exploit | ||
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is autom… | ||||
| CVE-2018-25032US | high7.5 | Exploit | ||
zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. | ||||
| CVE-2022-0547US | critical9.8 | — | ||
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, w… | ||||
| CVE-2022-23308US | high7.5 | — | ||
valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. | ||||
| CVE-2021-42386US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the nvalloc function | ||||
| CVE-2021-42385US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function | ||||
| CVE-2021-42384US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the handle_special function | ||||
| CVE-2021-42383US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the evaluate function | ||||
| CVE-2021-42382US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the getvar_s function | ||||
| CVE-2021-42381US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the hash_init function | ||||
| CVE-2021-42380US | high7.2 | — | ||
A use-after-free in Busybox's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the clrvar function | ||||
references
External citations — patches, advisories, analysis.
- SSA-942865: Multiple Vulnerabilities in the Integrated SCALANCE S615 of SINAMICS Medium Voltage Products - CSAF Versionself
- SSA-942865: Multiple Vulnerabilities in the Integrated SCALANCE S615 of SINAMICS Medium Voltage Products - HTML Versionself
- SSA-942865: Multiple Vulnerabilities in the Integrated SCALANCE S615 of SINAMICS Medium Voltage Products - PDF Versionself
- SSA-942865: Multiple Vulnerabilities in the Integrated SCALANCE S615 of SINAMICS Medium Voltage Products - TXT Versionself
- ICS Advisory ICSA-23-166-12 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-166-12 - Web Versionself
- Recommended Practicesexternal
remediations (46)
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- MitigationSINAMICS PERFECT HARMONY GH180 6SR5
Disconnect any direct network connection to the integrated SCALANCE S615 device
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
- FixedSINAMICS PERFECT HARMONY GH180 6SR5
Update the firmware of the integrated SCALANCE S615 device to V7.2 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan