SB2022041912 - Multiple vulnerabilities in Siemens SCALANCE W1700 Devices

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Input validation error (CVE-ID: CVE-2022-28329)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in the RemoteCapture feature. A remote attacker on the local network can send specially crafted TCP packets and perform a denial of service (DoS) attack.

2) Race condition (CVE-ID: CVE-2022-27481)

The vulnerability allows a remote attacker to perform a denial of servie (DoS) attack.

The vulnerability exists due to a race condition when handling ARP requests. A remote attacker on the local network can exploit the race and cause a denial of service condition on the target system.

3) Input validation error (CVE-ID: CVE-2022-28328)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can send specially crafted Multicast LLC frames and perform a denial of service (DoS) attack.

Remediation

Install update from vendor's website.

References

• https://cert-portal.siemens.com/productcert/pdf/ssa-392912.pdf