SSA-332410: Multiple Vulnerabilities in SINEC INS before V1.0 SP2 Update 1
Siemens has released a new version for SINEC INS that fixes multiple vulnerabilities that could allow an attacker to read and write arbitrary files from the file system of the affected component and to ultimately execute arbitrary code on the device. In addition, this version also contains fixes for multiple vulnerabilities in underlying third party components. Siemens has released an update for SINEC INS and recommends to update to the latest version.
beschreibt (12)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-45094US | high8.8 | — | ||
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affec… | ||||
| CVE-2022-45093US | high8.8 | — | ||
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affec… | ||||
| CVE-2022-45092US | high8.8 | — | ||
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affec… | ||||
| CVE-2022-35256US | medium6.5 | — | ||
The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling. | ||||
| CVE-2022-35255US | critical9.1OT erhöht | — | ||
A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. Ther… | ||||
| CVE-2022-32222US | medium5.3 | — | ||
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circu… | ||||
| CVE-2022-32215US | medium6.5 | — | ||
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. This can lead to HTTP Request Smug… | ||||
| CVE-2022-32213US | medium6.5 | — | ||
The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding headers and can lead to HTTP Request Smugg… | ||||
| CVE-2022-32212US | high8.1 | — | ||
A OS Command Injection vulnerability exists in Node.js versions <14.20.0, <16.20.0, <18.5.0 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddre… | ||||
| CVE-2022-2097US | medium5.3OT erhöht | Exploit | ||
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixte… | ||||
| CVE-2022-2274US | critical9.8 | Exploit | ||
The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This issue makes the RSA implementation with 20… | ||||
| CVE-2022-2068US | high7.3 | — | ||
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (14)
- MitigationSINEC INS
CVE-2022-45093: Disable the SFTP service of the affected product, if not required
- MitigationSINEC INS
CVE-2022-45094: Disable the DHCP service of the affected product, if not required
- BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/ - BehobenSINEC INS
Update to V1.0 SP2 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109815432/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan