CVE-2022-31812
published 2025-05-23CVE-2022-31812: A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds read past the end…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.58%
43.5th percentile
A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds read past the end of an allocated buffer while checking the integrity of incoming packets. This could allow an unauthenticated remote attacker to create a denial of service condition.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | sipass_integrated | < V2.95.3.18 | V2.95.3.18 |
| siemens | sipass_integrated | < 2.95.3.18 | 2.95.3.18 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_oracle5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Siemens SiPass Integrated
cisa_ics·2025-05-29·CVSS 7.5
[HIGH] Siemens SiPass Integrated
ICS Advisory
##
Siemens SiPass Integrated
Release DateMay 29, 2025
Alert CodeICSA-25-148-02
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 8.7
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SiPass integrated
- Vulnerability: Out-of-bounds Read
## 2. RISK EVALUATION
Successful exploitation of this vulnerability could allow
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Smart Answer (Apache PDFBox) — CVE-2021-31812
vendor_oracle·2022-07-15·CVSS 5.5
CVE-2021-31812 [MEDIUM] Oracle Oracle Siebel CRM Risk Matrix: Smart Answer (Apache PDFBox) — CVE-2021-31812
Oracle Oracle Siebel CRM Risk Matrix: Smart Answer (Apache PDFBox) vulnerability
CVE: CVE-2021-31812
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujul2022 (JUL 2022)
Oracle
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache PDFBox) — CVE-2021-31812
vendor_oracle·2022-04-15·CVSS 5.5
CVE-2021-31812 [MEDIUM] Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache PDFBox) — CVE-2021-31812
Oracle Oracle Financial Services Applications Risk Matrix: Infrastructure (Apache PDFBox) vulnerability
CVE: CVE-2021-31812
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpuapr2022 (APR 2022)
Oracle
Oracle Oracle Retail Applications Risk Matrix: Security (Apache PDFbox) — CVE-2021-31812
vendor_oracle·2022-01-15·CVSS 5.5
CVE-2021-31812 [MEDIUM] Oracle Oracle Retail Applications Risk Matrix: Security (Apache PDFbox) — CVE-2021-31812
Oracle Oracle Retail Applications Risk Matrix: Security (Apache PDFbox) vulnerability
CVE: CVE-2021-31812
CVSS: 5.5
Protocol: None
Remote exploit: No
Affected versions: Local
Advisory: cpujan2022 (JAN 2022)
GHSA
GHSA-xp23-94cq-8m5g: A vulnerability has been identified in SiPass integrated (All versions < V2
ghsa_unreviewed·2025-05-23
CVE-2022-31812 [HIGH] CWE-125 GHSA-xp23-94cq-8m5g: A vulnerability has been identified in SiPass integrated (All versions < V2
A vulnerability has been identified in SiPass integrated (All versions < V2.95.3.18). Affected server applications contain an out of bounds read past the end of an allocated buffer while checking the integrity of incoming packets. This could allow an unauthenticated remote attacker to create a denial of service condition.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-05-23
Published