CVE-2021-45960
highPriorität · beachten · 47EPSS 0.043 · 91. PerzentilExploit · PoCDEEURUUSEPSS · bewertet 2026-10-22
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, or only freeing memory).
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)siemens_psirt
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)siemens_psirt
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)siemens_psirt
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)siemens_psirt
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)siemens_psirt
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSINEMA Remote Connect Serversiemens_psirt
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811169/ - BehobenPROFINET SDKphoenix_contact_psirt
Use only trusted connections between the Engineering tools and the devices executing the Profinet stack. Update configuration tool chains to libexpat library version 2.4.6. or higher. Upgrade to PROFINET SDK 6.6 or higher if necessary.
- Behobenphoenix_contact_psirt
**Update to Firmware Release 2022.0.3 LTS or higher:** - AXC F 2152 (2404267) [Download](http://www.phoenixcontact.net/qr/2404267/firmware) - AXC F 1152 (1151412) [Download](http://www.phoenixcontact.net/qr/1151412/firmware) - AXC F 3152 (1069208) Not yet released **Update to PLCnext Engineer Release 2022.0.1 LTS or higher.**
- BehobenSINEMA Remote Connect Servercisa_csaf_ot
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811169/ - BehobenAFF66X FWcisa_csaf_ot
AFF66X FW 03.0.02 and earlier: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to upcoming AFF66X 04.x.xx FW when released.
- BehobenAFR677cisa_csaf_ot
AFS65X, AFS67X, AFR677 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to AFS65X, AFS67X, AFR677 09.1.08 FW. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server.
- BehobenAFS65Xcisa_csaf_ot
AFS65X, AFS67X, AFR677 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to AFS65X, AFS67X, AFR677 09.1.08 FW. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server.
- BehobenAFS660-Ccisa_csaf_ot
AFS66X-S, AFS660-C, AFS66X-B, AFS670-V20 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to upcoming AFS66X, AFS670-V20 7.1.08 FW when released. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server or restrict access to IEC61850-MMS to trusted IP addresses.
- BehobenAFS66X-Bcisa_csaf_ot
AFS66X-S, AFS660-C, AFS66X-B, AFS670-V20 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to upcoming AFS66X, AFS670-V20 7.1.08 FW when released. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server or restrict access to IEC61850-MMS to trusted IP addresses.
- BehobenAFS66X-Scisa_csaf_ot
AFS66X-S, AFS660-C, AFS66X-B, AFS670-V20 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to upcoming AFS66X, AFS670-V20 7.1.08 FW when released. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server or restrict access to IEC61850-MMS to trusted IP addresses.
- BehobenAFS670-V20cisa_csaf_ot
AFS66X-S, AFS660-C, AFS66X-B, AFS670-V20 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to upcoming AFS66X, AFS670-V20 7.1.08 FW when released. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server or restrict access to IEC61850-MMS to trusted IP addresses.
- BehobenAFS67Xcisa_csaf_ot
AFS65X, AFS67X, AFR677 devices: For all vulnerabilities, apply mitigation strategy as described in Hitachi Energy's general mitigation factors below or update to AFS65X, AFS67X, AFR677 09.1.08 FW. Disable HTTP/HTTPS server or restrict access to HTTP/HTTPS to trusted IP addresses. Disable IEC61850-MMS server.
- BehobenSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)cisa_csaf_ot
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)cisa_csaf_ot
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)cisa_csaf_ot
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)cisa_csaf_ot
Update to V3.1.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - MitigationPROFINET SDKphoenix_contact_psirt
The PROFINET SDK includes an Engineering tool as reference solution to generate Profinet configuration IPPNIO or TIC XML files. This configuration is transferred to a device running the Profinet stack and loaded during startup of the Profinet stack. When the IPPNIO or TIC files are transferred via an untrusted environment (e.g.: Network or e-Mail, …) an attacker knowing these vulnerabilities mentioned above might manipulate the files in a specific way to gain access to the device. To mitigate these vulnerabilities the integrity and authenticity of the configuration data it must be ensured by transferring the data only via trusted connections. Advice's how to ensure trusted connections can be found in the following document:Measures to protect network-capable devices with Ethernet connection. Companies which are using their own configuration system instead of the reference solution are not affected as long they don't utilize the related libexpat library. We kindly advise you to check if in your specific configuration tool chain, the libexpat library is used or version number is 2.4.6. or higher.
- Mitigationphoenix_contact_psirt
Phoenix Contact recommends operating network-capable devices in closed networks or protected with a suitable firewall. For detailed information on our recommendations for measures to protect network-capable devices, please refer to our application note: Measures to protect network-capable devices with Ethernet connection
- MitigationAFF66X FWcisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFR677cisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFS65Xcisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFS660-Ccisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFS66X-Bcisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFS66X-Scisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFS670-V20cisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationAFS67Xcisa_csaf_ot
Hitachi Energy's general mitigation factors:Security practices and firewall configurations can help protect a process control network from attacks that originate from outside the network. Such practices include that process control systems are physically protected from direct access by unauthorized personnel, have no direct connections to the Internet, and are separated from other networks by means of a firewall system that has a minimal number of ports exposed, and others that have to be evaluated case by case. Process control systems should not be used for Internet surfing, instant messaging, or receiving e-mails. Portable computers and removable storage media should be carefully scanned for viruses before they are connected to a control system.
- MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)cisa_csaf_ot
Only build and run applications from trusted sources.
- MitigationSIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)cisa_csaf_ot
Only build and run applications from trusted sources.
- MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)cisa_csaf_ot
Only build and run applications from trusted sources.
- MitigationSIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)cisa_csaf_ot
Only build and run applications from trusted sources.
- MitigationSIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)cisa_csaf_ot
Only build and run applications from trusted sources.
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
Exploits (2)
Öffentlicher Proof-of-Concept- und Exploit-Code.
betroffene Produkte (71)
Betroffene Produkte und Versionsbereiche.
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)≤ vers:intdot/>=3.1.0|<3.1.5cisa_csaf_otUS
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)≤ vers:intdot/>=3.1.0|<3.1.5cisa_csaf_otUS
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)≤ vers:intdot/>=3.1.0|<3.1.5cisa_csaf_otUS
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)≤ vers:intdot/>=3.1.0|<3.1.5cisa_csaf_otUS
- Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)≤ vers:intdot/>=3.1.0|<3.1.5cisa_csaf_otUS
Advisories (12)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-398330SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.52023-12-12csaf · siemens_psirtDE
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 are no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 (https://cert-portal.siemens.com/productcert/html/ssb-439005.html).
- SSA-484086SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.12022-06-14csaf · siemens_psirtDE
SINEMA Remote Connect Server is affected by multiple vulnerabilities, including - A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) - Several authentication bypass, privilege escalation and integrity check vulnerabilities (CVE-2022-32251 through -32261) - A command injection vulnerability in the file upload service (CVE-2022-32262) - A chosen-plaintext attack against HTTP over TLS ("BREACH", CVE-2022-27221) - Information disclosure vulnerabilities in the curl component (CVE-2021-22924 through -22925) - Several vulnerabilities in the libexpat library, that could be exploited when the server is parsing untrusted XML files (CVE-2021-45960, CVE-2021-46143, CVE-2022-22822 through -22827, CVE-2022-23852, CVE-2022-23990, CVE-2022-25235 through -25236, CVE-2022-25313 through -25315. Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to the latest version. Note that the update also contains additional fixes for vulnerabilities documented in Siemens Security Advisories SSA-244969, SSA-539476, SSA-685781 and SSA-712929.
- VDE-2022-005PHOENIX CONTACT: Vulnerabilities in XML parser library Expat (libexpat)2022-03-30csaf · phoenix_contact_psirtDE
Several vulnerabilities have been discovered in the Expat XML parser library (aka libexpat).This open-source component is widely used in a lot of products worldwide.A remote, anonymous attacker could use an integer overflow to execute arbitrary program code when loading specially crafted XML files. Profinet SDK is using XML parser library Expat as reference solution for loading the XML based Profinet network configuration files (IPPNIO or TIC).
- VDE-2022-010PHOENIX CONTACT: Multiple Linux component vulnerabilities fixed in latest AXC F x152 LTS release2022-04-12csaf · phoenix_contact_psirtDE
PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities. Firmware components in version 2021.06 had already been updated. For the 2022.0 LTS version more firmware components have been updated implicitly fixing the vulnerabilities listed. The vulnerabilities listed above have not been individually verified in terms of actual impact and/or limitations in combination with the affected products listed. The current LTS release 2022.0 LTS contains updates of integrated third-party libraries, SDKs and other third-party software to address these issues nevertheless. UPDATE A (April 4th, 2022): Added RFC 4072 (Art. No. 1051328) and fixed affected version of AXC F 3152
- WID-SEC-W-2022-0246expat: Mehrere SchwachstellenDeutsch2022-01-17csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in expat ausnutzen, um einen Denial of Service Angriff durchzuführen oder potentiell Code zur Ausführung zu bringen.
- WID-SEC-W-2022-0302Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit AdministratorrechtenDeutsch2022-06-14csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.
- WID-SEC-W-2022-0432Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2022-06-21csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität zu gefährden.
- WID-SEC-W-2022-1335Xerox FreeFlow Print Server: Mehrere SchwachstellenDeutsch2022-09-07csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.
- WID-SEC-W-2023-2639Hitachi Energy AFS: Mehrere SchwachstellenDeutsch2023-10-12csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Hitachi Energy AFS ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu verursachen oder vertrauliche Informationen offenzulegen.
- ICSA-22-167-17Siemens OpenSSL Affecting Industrial Products2022-06-14icsa · cisa_csaf_otUS
SINEMA Remote Connect Server is affected by multiple vulnerabilities, including - A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) - Several authentication bypass, privilege escalation and integrity check vulnerabilities (CVE-2022-32251 through -32261) - A command injection vulnerability in the file upload service (CVE-2022-32262) - A chosen-plaintext attack against HTTP over TLS ("BREACH", CVE-2022-27221) - Information disclosure vulnerabilities in the curl component (CVE-2021-22924 through -22925) - Several vulnerabilities in the libexpat library, that could be exploited when the server is parsing untrusted XML files (CVE-2021-45960, CVE-2021-46143, CVE-2022-22822 through -22827, CVE-2022-23852, CVE-2022-23990, CVE-2022-25235 through -25236, CVE-2022-25313 through -25315. Siemens has released an update for the SINEMA Remote Connect Server and recommends to update to the latest version. Note that the update also contains additional fixes for vulnerabilities documented in Siemens Security Advisories SSA-244969, SSA-539476, SSA-685781 and SSA-712929.
- ICSA-23-278-01Hitachi Energy AFS65x,AFF66x, AFS67x, and AFR67x Series Products2023-10-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities by an attacker could have a high impact on availability, integrity, and confidentiality of the targeted devices.
- ICSA-23-348-10Siemens SIMATIC S7-15002023-12-12icsa · cisa_csaf_otUS
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 ( https://cert-portal.siemens.com/productcert/html/ssb-439005.html).
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (68)
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2022/01/17/3cnnvd
- https://bugzilla.mozilla.org/show_bug.cgi?id=1217609cnnvd
- https://cert-portal.siemens.com/productcert/pdf/ssa-484086.pdfcnnvd
- https://github.com/libexpat/libexpat/issues/531cnnvd
- https://github.com/libexpat/libexpat/pull/534cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2021-45960cnnvd
- https://packetstormsecurity.com/files/166088/Ubuntu-Security-Notice-USN-5288-1.htmlcnnvd
- https://packetstormsecurity.com/files/166348/Red-Hat-Security-Advisory-2022-0951-01.htmlcnnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan