siemens ruggedcom_rm1224_firmware 输入验证不恰当

CVE编号

CVE-2022-31766

利用情况

暂无

补丁情况

N/A

披露时间

2022-10-11
漏洞描述
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (All versions < V7.1.2), SCALANCE M804PB (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (Annex A) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (Annex B) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (Annex A) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (Annex B) (All versions < V7.1.2), SCALANCE M826-2 SHDSL-Router (All versions < V7.1.2), SCALANCE M874-2 (All versions < V7.1.2), SCALANCE M874-3 (All versions < V7.1.2), SCALANCE M876-3 (EVDO) (All versions < V7.1.2), SCALANCE M876-3 (ROK) (All versions < V7.1.2), SCALANCE M876-4 (EU) (All versions < V7.1.2), SCALANCE M876-4 (NAM) (All versions < V7.1.2), SCALANCE MUM853-1 (EU) (All versions < V7.1.2), SCALANCE MUM856-1 (EU) (All versions < V7.1.2), SCALANCE MUM856-1 (RoW) (All versions < V7.1.2), SCALANCE S615 (All versions < V7.1.2), SCALANCE WAM763-1 (All versions >= V1.1.0), SCALANCE WAM766-1 (All versions >= V1.1.0), SCALANCE WAM766-1 (All versions >= V1.1.0), SCALANCE WAM766-1 6GHz (All versions >= V1.1.0), SCALANCE WAM766-1 EEC (All versions >= V1.1.0), SCALANCE WAM766-1 EEC (All versions >= V1.1.0), SCALANCE WAM766-1 EEC 6GHz (All versions >= V1.1.0), SCALANCE WUM763-1 (All versions >= V1.1.0), SCALANCE WUM763-1 (All versions >= V1.1.0), SCALANCE WUM766-1 (All versions >= V1.1.0), SCALANCE WUM766-1 (All versions >= V1.1.0), SCALANCE WUM766-1 6GHz (All versions >= V1.1.0). Affected devices with TCP Event service enabled do not properly handle malformed packets. This could allow an unauthenticated remote attacker to cause a denial of service and reboot the device thus possibly affecting other network resources.
解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。
参考链接
https://cert-portal.siemens.com/productcert/pdf/ssa-697140.pdf
受影响软件情况
# 类型 厂商 产品 版本 影响面
1
运行在以下环境
系统 siemens ruggedcom_rm1224_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m804pb_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m812-1_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m816-1_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m826-2_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m874-2_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m874-3_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m876-3_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_m876-4_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_mum853-1_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_mum856-1_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_s615_firmware * Up to
(excluding)
7.1.2
运行在以下环境
系统 siemens scalance_wam763-1_firmware * From
(including)
1.1.0
运行在以下环境
系统 siemens scalance_wam766-1_firmware * From
(including)
1.1.0
运行在以下环境
系统 siemens scalance_wum763-1_firmware * From
(including)
1.1.0
运行在以下环境
系统 siemens scalance_wum766-1_firmware * From
(including)
1.1.0
运行在以下环境
硬件 siemens ruggedcom_rm1224 - -
运行在以下环境
硬件 siemens scalance_m804pb - -
运行在以下环境
硬件 siemens scalance_m812-1 - -
运行在以下环境
硬件 siemens scalance_m816-1 - -
运行在以下环境
硬件 siemens scalance_m826-2 - -
运行在以下环境
硬件 siemens scalance_m874-2 - -
运行在以下环境
硬件 siemens scalance_m874-3 - -
运行在以下环境
硬件 siemens scalance_m876-3 - -
运行在以下环境
硬件 siemens scalance_m876-4 - -
运行在以下环境
硬件 siemens scalance_mum853-1 - -
运行在以下环境
硬件 siemens scalance_mum856-1 - -
运行在以下环境
硬件 siemens scalance_s615 - -
运行在以下环境
硬件 siemens scalance_wam763-1 - -
运行在以下环境
硬件 siemens scalance_wam766-1 - -
运行在以下环境
硬件 siemens scalance_wum763-1 - -
运行在以下环境
硬件 siemens scalance_wum766-1 - -
CVSS3评分
8.6
  • 攻击路径
    网络
  • 攻击复杂度
    低
  • 权限要求
    无
  • 影响范围
    已更改
  • 用户交互
    无
  • 可用性
    高
  • 保密性
    无
  • 完整性
    无
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CWE-ID 漏洞类型
CWE-20 输入验证不恰当
阿里云安全产品覆盖情况