SSA-935500

csafDEsiemens_psirt

SSA-935500: Denial of Service Vulnerability in FTP Server of Nucleus RTOS based APOGEE, TALON and Desigo PXC/PXM Products

Advisory ansehen veröffentlicht 2022-10-11

A denial of service vulnerability has been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-313313: https://cert-portal.siemens.com/productcert/html/ssa-313313.html. The products listed below use affected versions of the Nucleus software and inherently contain the vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2022-38371UShigh7.5—
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (46)

  • MitigationAPOGEE MBC (PPC) (BACnet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE MBC (PPC) (P2 Ethernet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE MEC (PPC) (BACnet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE MEC (PPC) (P2 Ethernet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE PXC Compact (BACnet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE PXC Compact (P2 Ethernet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE PXC Modular (BACnet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationAPOGEE PXC Modular (P2 Ethernet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC00-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC00-U

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC001-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC100-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC12-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC128-U

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC200-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC22-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC22.1-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC36.1-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC50-E.D

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXC64-U

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationDesigo PXM20-E

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationTALON TC Compact (BACnet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • MitigationTALON TC Modular (BACnet)

    Disable the FTP service (Note that the FTP service is disabled by default on APOGEE, Desigo, and TALON products.)

  • Kein Fix geplantAPOGEE MBC (PPC) (BACnet)

    Currently no fix is planned

  • Kein Fix geplantAPOGEE MBC (PPC) (P2 Ethernet)

    Currently no fix is planned

  • Kein Fix geplantAPOGEE MEC (PPC) (BACnet)

    Currently no fix is planned

  • Kein Fix geplantAPOGEE MEC (PPC) (P2 Ethernet)

    Currently no fix is planned

  • BehobenAPOGEE PXC Compact (BACnet)

    Update to V3.5.7 or later version

    https://partnerportal.extranet.dc.siemens.com/
  • BehobenAPOGEE PXC Compact (P2 Ethernet)

    Update to V2.8.21 or later version

    https://partnerportal.extranet.dc.siemens.com/
  • BehobenAPOGEE PXC Modular (BACnet)

    Update to V3.5.7 or later version

    https://partnerportal.extranet.dc.siemens.com/
  • BehobenAPOGEE PXC Modular (P2 Ethernet)

    Update to V2.8.21 or later version

    https://partnerportal.extranet.dc.siemens.com/
  • BehobenDesigo PXC00-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC00-U

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC001-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC100-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC12-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC128-U

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC200-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC22-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC22.1-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC36.1-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC50-E.D

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXC64-U

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenDesigo PXM20-E

    Update to V6.30.37 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109987277/
  • BehobenTALON TC Compact (BACnet)

    Update to V3.5.7 or later version

    https://partnerportal.extranet.dc.siemens.com/
  • BehobenTALON TC Modular (BACnet)

    Update to V3.5.7 or later version

    https://partnerportal.extranet.dc.siemens.com/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan