Siemens SINEC NMS Third-Party
Multiple vulnerabilities affecting third-party components libexpat and libcurl of SINEC NMS before V1.0.3.1 could allow an attacker to impact SINEC NMS confidentiality, integrity and availability. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
describes (9)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-43552US | medium5.9 | — | ||
A use after free vulnerability exists in curl <7.87.0. Curl can be asked to *tunnel* virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny… | ||||
| CVE-2022-43551US | high7.5OT elevated | — | ||
A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use HTTPS instead of usin… | ||||
| CVE-2022-35260US | medium6.5 | — | ||
curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the en… | ||||
| CVE-2022-32221US | critical9.8 | — | ||
When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIELDS` option has been s… | ||||
| CVE-2022-42915US | high8.1 | — | ||
curl before 7.86.0 has a double free. If curl is told to use an HTTP proxy for a transfer with a non-HTTP(S) URL, it sets up the connection to the remote server by issuing a CONNEC… | ||||
| CVE-2022-42916US | high7.5OT elevated | — | ||
In curl before 7.86.0, the HSTS check could be bypassed to trick it into staying with HTTP. Using its HSTS support, curl can be instructed to use HTTPS directly (instead of using a… | ||||
| CVE-2022-43680US | high7.5 | Exploit | ||
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations. | ||||
| CVE-2022-35252US | low3.7 | — | ||
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server ret… | ||||
| CVE-2022-40674US | high8.1 | — | ||
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | ||||
references
External citations — patches, advisories, analysis.
- SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - CSAF Versionself
- SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - HTML Versionself
- SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - PDF Versionself
- SSA-892048: Third-Party Component Vulnerabilities in SINEC NMS before V1.0.3.1 - TXT Versionself
- ICS Advisory ICSA-23-131-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-131-05 - Web Versionself
- Recommended Practicesexternal
remediations (9)
- FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/ - FixedSINEC NMS
Update to V1.0.3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109818269/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan