CVE-2022-21198
mediumPriorität · verfolgen · 26EPSS 0.002 · 4. PerzentilDEEUUSEPSS · bewertet 2026-10-27
Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenSIMATIC Field PG M5siemens_psirt
Update to V22.01.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC Field PG M6siemens_psirt
Update to V26.01.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC BX-39Asiemens_psirt
Update to V29.01.03 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC PX-39Asiemens_psirt
Update to V29.01.03 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC PX-39A PROsiemens_psirt
Update to V29.01.03 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC427Esiemens_psirt
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC477Esiemens_psirt
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC477E Prosiemens_psirt
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC627Esiemens_psirt
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC647Esiemens_psirt
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC677Esiemens_psirt
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC847Esiemens_psirt
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIPLUS IPC427Esiemens_psirt
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC Field PG M5cisa_csaf_ot
Update to V22.01.11 or later version
- BehobenSIMATIC Field PG M6cisa_csaf_ot
Update to V26.01.11 or later version
- BehobenSIMATIC IPC BX-39Acisa_csaf_ot
Update to V29.01.03 or later version
- BehobenSIMATIC IPC PX-39Acisa_csaf_ot
Update to V29.01.03 or later version
- BehobenSIMATIC IPC PX-39A PROcisa_csaf_ot
Update to V29.01.03 or later version
- BehobenSIMATIC IPC427Ecisa_csaf_ot
Update to V21.01.19 or later version
- BehobenSIMATIC IPC477Ecisa_csaf_ot
Update to V21.01.19 or later version
- BehobenSIMATIC IPC477E Procisa_csaf_ot
Update to V21.01.19 or later version
- BehobenSIMATIC IPC627Ecisa_csaf_ot
Update to V25.02.14 or later version
- BehobenSIMATIC IPC647Ecisa_csaf_ot
Update to V25.02.14 or later version
- BehobenSIMATIC IPC677Ecisa_csaf_ot
Update to V25.02.14 or later version
- BehobenSIMATIC IPC847Ecisa_csaf_ot
Update to V25.02.14 or later version
- BehobenSIPLUS IPC427Ecisa_csaf_ot
Update to V21.01.19 or later version
- MitigationSIMATIC Field PG M5siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC Field PG M6siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC BX-39Asiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC PX-39Asiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC PX-39A PROsiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC477Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC477E Prosiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC627Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC647Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC677Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC847Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC ITP1000siemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIPLUS IPC427Esiemens_psirt
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC Field PG M5cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC Field PG M6cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC BX-39Acisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC PX-39Acisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC PX-39A PROcisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC427Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC477Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC477E Procisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC627Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC647Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC677Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC IPC847Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIMATIC ITP1000cisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- WorkaroundSIPLUS IPC427Ecisa_csaf_ot
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- Kein Fix verfügbarSIMATIC ITP1000cisa_csaf_ot
Currently no fix is available
- Kein Fix geplantSIMATIC ITP1000siemens_psirt
Currently no fix is planned
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.9–7.9
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (509)
Betroffene Produkte und Versionsbereiche.
Advisories (3)
Hersteller- und Ökosystem-Meldungen dazu.
- SSA-686975SSA-686975: IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs2023-02-14csaf · siemens_psirtDE
Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update ("2022.3 IPU – BIOS Advisory" Intel-SA-00688). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
- WID-SEC-W-2022-1984Intel BIOS: Mehrere Schwachstellen ermöglichen PrivilegieneskalationDeutsch2022-11-08csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Intel BIOS ausnutzen, um seine Privilegien zu erhöhen.
- ICSA-23-047-09Siemens SIMATIC Industrial Products2023-02-14icsa · cisa_csaf_otUS
Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update ("2022.3 IPU – BIOS Advisory" Intel-SA-00688). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
auch bekannt als (3)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (9)
Externe Belege — Patches, Meldungen, Analysen.
- https://cxsecurity.com/cveshow/CVE-2022-21198/cnnvd
- https://vigilance.fr/vulnerability/Intel-Processors-two-vulnerabilities-via-BIOS-Firmware-39878cnnvd
- https://www.auscert.org.au/bulletins/ESB-2022.5835cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.0968cnnvd
- https://www.auscert.org.au/bulletins/ESB-2023.1209cnnvd
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00688.htmlcnnvd
- https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00688.htmlenisa_euvd
- https://cert-portal.siemens.com/productcert/html/ssa-686975.htmlnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan