CVE-2022-32208

mediumpriority · track · 27EPSS 0.084 · 95 %ileDEEUFRRUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
8.37% (95th) EPSS
CVSS 4.3 · medium
Is it mine?
81 products
Check your exposure
Who says so?
9 sources
cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

When curl < 7.84.0 does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.9
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.04.3mediumAV:N/AC:M/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 2.9
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nprimary · NVD / NIST USexploitability 2.2 · impact 3.6
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · CISA US
v3.15.9mediumAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · FSTEC (BDU) RU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondaryexploitability 2.2 · impact 3.6
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Csecondary · Siemens ProductCERT DE
v3.15.9mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Phoenix Contact PSIRT DE
v3.15.4mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-787USprimaryCWE-787USCWE-787USCWE-787USCWE-787USCWE-840US
05

affected products (81)

Products and version ranges known to be affected.

showing 20 of 81
06

advisories (22)

Vendor and ecosystem advisories describing this.

  • SSA-398330SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.52023-12-12csaf · siemens_psirtDE

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 are no longer maintained and there won't be any update to the CVE list anymore. Please update to the latest version. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 (https://cert-portal.siemens.com/productcert/html/ssb-439005.html).

  • SSA-419740SSA-419740: Multiple Third-Party Component Vulnerabilities in RUGGEDCOM and SCALANCE Products before V7.22023-03-14csaf · siemens_psirtDE

    Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • SSA-558014SSA-558014: Third-Party Component Vulnerabilities in SCALANCE XCM332 before V2.22023-04-11csaf · siemens_psirtDE

    Multiple vulnerabilities in the third-party components cURL, BusyBox, libtirpc, Expat as well as in the Linux Kernel could allow an attacker to impact the SCALANCE XCM332 device's confidentiality, integrity and availability. Siemens has released an update for the SCALANCE XCM332 and recommends to update to the latest version.

  • SSA-942865SSA-942865: Multiple Vulnerabilities in the Integrated SCALANCE S615 of SINAMICS Medium Voltage Products2023-06-13csaf · siemens_psirtDE

    SINAMICS PERFECT HARMONY GH180 is affected by multiple vulnerabilities in the integrated SCALANCE S615 device, as documented in SSA-419740 ( https://cert-portal.siemens.com/productcert/html/ssa-419740.html). Siemens recommends to update the firmware of the integrated SCALANCE S615 device to the latest version. Siemens recommends specific countermeasures for products where the firmware update is not, or not yet applied. Additional considerations regarding the specific impact of the vulnerabilities to SINAMICS MV products can be found in the chapter "Additional Information".

  • VDE-2022-046PHOENIX CONTACT: Multiple Linux component vulnerabilities in PLCnext Firmware2022-11-10csaf · phoenix_contact_psirtDE

    UPDATE A: Two devices (ENERGY AXC PU, SMARTRTU AXC SG) added (24.11.2022) Update for PLCnext Firmware containing fixes for recent vulnerability findings in Linux components and security enhancements. PLCnext Control AXC F x152 is certified according to IEC 62443-4-1 and IEC 62443-4-2. This certification requires that all third-party components used in the firmware are regularly checked for known vulnerabilities.

  • VDE-2023-001PHOENIX CONTACT: Multiple Vulnerabilities in PLCnext Firmware2023-02-14csaf · phoenix_contact_psirtDE

    A new LTS Firmware release fixes known vulnerabilities in used open-source libraries. In addition, the following improvements have been implemented: HMI - Hardening against DoS attacks. - Hardening against memory leak problems in case of network attacks. WBM - Umlauts in the password of the 'User Manager' were not handled correctly. The password rule for upper and lower case was not followed. This could lead to unintentionally weaker passwords.- Hardening of WBM against Cross-Site-Scripting. User Manager - In security notifications 'SecurityToken' was always displayed as '0000000' when creating or modifying users.- Hardening of Trust and Identity Stores.

  • WID-SEC-W-2022-0479cURL: Mehrere SchwachstellenDeutsch2022-06-26csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitseinstellungen zu umgehen und Daten offenzulegen oder zu manipulieren.

  • WID-SEC-W-2022-1846Apple macOS: Mehrere SchwachstellenDeutsch2022-10-24csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Apple macOS ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, beliebigen Programmcode auszuführen, seine Privilegien zu erweitern, einen Denial of Service Zustand herbeizuführen, Dateien zu manipulieren, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.

  • WID-SEC-W-2023-1350Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von DrittanbieternDeutsch2023-06-01csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise in diversen Komponenten von Drittanbietern ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

  • WID-SEC-W-2023-1424Xerox FreeFlow Print Server für Solaris: Mehrere SchwachstellenDeutsch2023-06-12csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um die Vertraulichkeit, Verfügbarkeit und Integrität des Systems zu gefährden.

  • WID-SEC-W-2023-1614Tenable Security Nessus Network Monitor: Mehrere SchwachstellenDeutsch2023-06-29csaf · cert_bundDE

    Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Tenable Security Nessus Network Monitor ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen und Daten zu manipulieren.

  • WID-SEC-W-2023-1728Autodesk AutoCAD: Mehrere SchwachstellenDeutsch2023-07-11csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Autodesk AutoCAD ausnutzen, um einen Denial of Service Zustand herbeizuführen, Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder Informationen offenzulegen.

  • WID-SEC-W-2023-2229Splunk Splunk Enterprise: Mehrere SchwachstellenDeutsch2023-08-30csaf · cert_bundDE

    Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen 'Denial of Service'-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.

  • WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.

  • WID-SEC-W-2024-3377Dell PowerProtect Data Domain: Mehrere SchwachstellenDeutsch2024-11-07csaf · cert_bundDE

    Ein lokaler Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um seine Privilegien zu erhöhen, Informationen offenzulegen und um nicht näher beschriebene Auswirkungen zu erzielen.

  • WID-SEC-W-2026-0180Dell Data Protection Advisor: Mehrere SchwachstellenDeutsch2026-01-20csaf · cert_bundDE

    Ein Angreifer kann mehrere Schwachstellen in Dell Data Protection Advisor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Sicherheitsmaßnahmen zu umgehen und nicht näher spezifizierte Angriffe zu starten.

  • ICSA-23-075-01Siemens SCALANCE, RUGGEDCOM Third-Party2023-03-14icsa · cisa_csaf_otUS

    Multiple third-party component vulnerabilities were reported for the Busybox applet, the Linux Kernel, OpenSSL, OpenVPN and various other components used by the RUGGEDCOM and SCALANCE products. The vulnerabilities range from improper neutralization of special elements to improper handling of commands under certain circumstances, that could lead to code injection and denial of service. Siemens has released updates for the affected products and recommends to update to the latest versions.

  • ICSA-23-103-09Siemens SCALANCE XCM3322023-04-11icsa · cisa_csaf_otUS

    Multiple vulnerabilities in the third-party components cURL, BusyBox, libtirpc, Expat as well as in the Linux Kernel could allow an attacker to impact the SCALANCE XCM332 device's confidentiality, integrity and availability. Siemens has released an update for the SCALANCE XCM332 and recommends to update to the latest version.

  • ICSA-23-166-12Siemens SINAMICS Medium Voltage Products2023-06-13icsa · cisa_csaf_otUS

    SINAMICS PERFECT HARMONY GH180 is affected by multiple vulnerabilities in the integrated SCALANCE S615 device, as documented in SSA-419740 ( https://cert-portal.siemens.com/productcert/html/ssa-419740.html). Siemens recommends to update the firmware of the integrated SCALANCE S615 device to the latest version. Siemens recommends specific countermeasures for products where the firmware update is not, or not yet applied. Additional considerations regarding the specific impact of the vulnerabilities to SINAMICS MV products can be found in the chapter "Additional Information".

  • ICSA-23-348-10Siemens SIMATIC S7-15002023-12-12icsa · cisa_csaf_otUS

    Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version >= V3.1.0 and < V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). These GNU/Linux vulnerabilities have been externally identified. Siemens has released new versions for the affected products and recommends to update to the latest versions. Note: This SSA advises vulnerabilities for firmware version V3.1 only; for versions < V3.1 refer to Siemens Security Bulletin SSB-439005 ( https://cert-portal.siemens.com/productcert/html/ssb-439005.html).

  • CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
  • CURL-CVE-2022-32208FTP-KRB bad message verification2022-06-27vendor · osvUS

    When curl does FTP transfers secured by krb5, it handles message verification failures wrongly. This flaw makes it possible for a Man-In-The-Middle attack to go unnoticed and even allows it to inject data to the client.

07

also known as (4)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bducert_bundcisa_csaf_otsiemens_psirtphoenix_contact_psirtcertfrosvNVDCVE.orgMITRE
published 2022-07-07modified 2026-06-17
10

references (60)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan