Siemens SCALANCE XCM332
view advisory published 2023-04-11
Multiple vulnerabilities in the third-party components cURL, BusyBox, libtirpc, Expat as well as in the Linux Kernel could allow an attacker to impact the SCALANCE XCM332 device's confidentiality, integrity and availability. Siemens has released an update for the SCALANCE XCM332 and recommends to update to the latest version.
01
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-35252US | low3.7 | — | ||
When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server ret… | ||||
| CVE-2022-40674US | high8.1 | — | ||
libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. | ||||
| CVE-2022-1729US | high7.0 | — | ||
A race condition was found the Linux kernel in perf_event_open() which can be exploited by an unprivileged user to gain root privileges. The bug allows to build several exploit pri… | ||||
| CVE-2021-46828US | high7.5 | — | ||
In libtirpc before 1.3.3rc1, remote attackers could exhaust the file descriptors of a process that uses libtirpc because idle TCP connections are mishandled. This can, in turn, lea… | ||||
| CVE-2022-32208US | medium5.9 | — | ||
When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed… | ||||
| CVE-2022-32207US | critical9.8OT elevated | — | ||
When curl < 7.84.0 saves cookies, alt-svc and hsts data to local files, it makes the operation atomic by finalizing the operation with a rename from a temporary name to the final t… | ||||
| CVE-2022-32206US | medium6.5 | — | ||
curl < 7.84.0 supports "chained" HTTP compression algorithms, meaning that a serverresponse can be compressed multiple times and potentially with different algorithms. The number o… | ||||
| CVE-2022-32205US | medium4.3 | — | ||
A malicious server can serve excessive amounts of `Set-Cookie:` headers in a HTTP response to curl and curl < 7.84.0 stores all of them. A sufficiently large amount of (big) cookie… | ||||
| CVE-2022-1652US | high7.8 | — | ||
Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a speciall… | ||||
| CVE-2022-30065US | high7.8 | — | ||
A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. | ||||
02
references
External citations — patches, advisories, analysis.
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - CSAF Versionself
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - HTML Versionself
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - PDF Versionself
- SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.2 - TXT Versionself
- ICS Advisory ICSA-23-103-09 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-103-09 - Web Versionself
- Recommended Practicesexternal
03
remediations (10)
- FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/ - FixedSCALANCE XCM332 (6GK5332-0GA01-2AC2)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109817513/
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan