SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP
SiPass integrated ACC (Advanced Central Controller) devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-31808US | high7.8 | — | ||
A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly… | ||||
references
External citations — patches, advisories, analysis.
- SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP - CSAF Versionself
- SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP - PDF Versionself
- SSA-658793: Command Injection Vulnerability in SiPass integrated AC5102 / ACC-G2 and ACC-AP - TXT Versionself
remediations (4)
- MitigationSiPass integrated AC5102 (ACC-G2)
Disable telnet access
- MitigationSiPass integrated ACC-AP
Disable telnet access
- FixedSiPass integrated AC5102 (ACC-G2)
Update to V2.85.44 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814044/ - FixedSiPass integrated ACC-AP
Update to V2.85.43 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814044/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan