CVE-2022-34819
published 2022-07-12CVE-2022-34819: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions…
PriorityP262critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
EPSS
1.52%
71.5th percentile
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions = V2.0 = V2.0 = V2.0 = V2.0 = V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application lacks proper validation of user-supplied data when parsing specific messages. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of device.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | simatic_cp_1242-7_v2 | — | — |
| siemens | simatic_cp_1243-1 | — | — |
| siemens | simatic_cp_1243-7_lte_eu | — | — |
| siemens | simatic_cp_1243-7_lte_us | — | — |
| siemens | simatic_cp_1243-8_irc | — | — |
| siemens | simatic_cp_1542sp-1_irc | — | — |
| siemens | simatic_cp_1542sp-1_irc_firmware | >= 2.0 | — |
| siemens | simatic_cp_1543-1 | — | — |
| siemens | simatic_cp_1543-1_firmware | < 3.0.22 | 3.0.22 |
| siemens | simatic_cp_1543sp-1 | — | — |
| siemens | simatic_cp_1543sp-1_firmware | >= 2.0 | — |
| siemens | siplus_et_200sp_cp_1542sp-1_irc_tx_rail | — | — |
| siemens | siplus_et_200sp_cp_1542sp-1_irc_tx_rail_firmware | >= 2.0 | — |
| siemens | siplus_et_200sp_cp_1543sp-1_isec | — | — |
| siemens | siplus_et_200sp_cp_1543sp-1_isec_firmware | >= 2.0 | — |
| siemens | siplus_et_200sp_cp_1543sp-1_isec_tx_rail | — | — |
| siemens | siplus_et_200sp_cp_1543sp-1_isec_tx_rail_firmware | >= 2.0 | — |
| siemens | siplus_net_cp_1242-7_v2 | — | — |
| siemens | siplus_net_cp_1543-1 | — | — |
| siemens | siplus_net_cp_1543-1_firmware | < 3.0.22 | 3.0.22 |
| siemens | siplus_s7-1200_cp_1243-1 | — | — |
| siemens | siplus_s7-1200_cp_1243-1_rail | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2022-34819 is a heap-based buffer overflow (CWE-122) triggered by parsing specific messages in the SRCS VPN feature of affected SIMATIC CP devices; monitor for anomalous or malformed message traffic directed at these devices over the SINEMA Remote Connect Server VPN channel. ↗
- →The vulnerability is exploitable remotely with low attack complexity, no privileges required, and no user interaction (CVSS v3 10.0, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H); prioritize detection of unsolicited inbound connections to affected CP devices. ↗
- →Block or alert on UDP port 5243 traffic at the network perimeter as a detection/prevention measure for exploitation attempts targeting the SRCS VPN feature. ↗
- ·No known public exploits specifically target these vulnerabilities at time of advisory publication. ↗
- ·Exploitation requires the SINEMA Remote Connect Server (SRCS) VPN feature to be in use; disabling this feature removes the attack surface for CVE-2022-34819. ↗
- ·Several affected product variants (SIMATIC CP 1542SP-1 IRC, CP 1543SP-1, and SIPLUS ET 200SP variants) have no fixed version available; all versions v2.0 and later remain affected with no patch listed. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-x7cp-9x6c-2mm8: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions), SIMATIC CP 1243-1 (All versions), SIMATIC CP 1243-7 LTE EU (All versions),
ghsa_unreviewed·2022-07-13
CVE-2022-34819 [CRITICAL] CWE-122 GHSA-x7cp-9x6c-2mm8: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions), SIMATIC CP 1243-1 (All versions), SIMATIC CP 1243-7 LTE EU (All versions),
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions), SIMATIC CP 1243-1 (All versions), SIMATIC CP 1243-7 LTE EU (All versions), SIMATIC CP 1243-7 LTE US (All versions), SIMATIC CP 1243-8 IRC (All versions), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0), SIMATIC CP 1543-1 (All versions = V2.0), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0), SIPLUS NET CP 1242-7 V2 (All versions), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions), SIPLUS S7-1200 CP 1243-1 RAIL (All versions). The application lacks proper validation of user-supplied data when parsing specific messages. This could result in a heap
CISA ICS
Siemens SRCS VPN Feature in SIMATIC CP Devices (Update A)
cisa_ics·2022-07-14
Siemens SRCS VPN Feature in SIMATIC CP Devices (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Siemens SRCS VPN Feature in SIMATIC CP Devices (Update A)
Last RevisedAugust 11, 2022
Alert CodeICSA-22-195-12
## As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: SIMATIC CP Devices
- Vuln
No detection rules found.
No public exploits indexed.
2022-07-12
Published