CVE-2022-38371

published 2022-10-11

CVE-2022-38371: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All…

high 8.7 CVSS 4.0

AV N AC L AT N PR N UI N VC N VI N VA H SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 = V2.3 < V6.30.37), Nucleus NET for Nucleus PLUS V1 (All versions < V5.2a), Nucleus NET for Nucleus PLUS V2 (All versions < V5.4), Nucleus ReadyStart V3 V2012 (All versions < V2012.08.1), Nucleus ReadyStart V3 V2017 (All versions < V2017.02.4), Nucleus Source Code (All versions including affected FTP server), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.

Affected

39 ranges · showing 25

Vendor	Product	Version range	Fixed in
siemens	apogee_mbc	—	—
siemens	apogee_mec	—	—
siemens	apogee_pxc_compact	< V3.5.7	V3.5.7
siemens	apogee_pxc_compact	< V2.8.21	V2.8.21
siemens	apogee_pxc_modular	< V3.5.7	V3.5.7
siemens	apogee_pxc_modular	< V2.8.21	V2.8.21
siemens	desigo_pxc00-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc00-e.d_firmware	<= 2.3	—
siemens	desigo_pxc00-u	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc00-u_firmware	<= 2.3	—
siemens	desigo_pxc001-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc001-e.d_firmware	<= 2.3	—
siemens	desigo_pxc100-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc100-e.d_firmware	<= 2.3	—
siemens	desigo_pxc12-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc12-e.d_firmware	<= 2.3	—
siemens	desigo_pxc128-u	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc128-u_firmware	<= 2.3	—
siemens	desigo_pxc200-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc200-e.d_firmware	<= 2.3	—
siemens	desigo_pxc22-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc22-e.d_firmware	<= 2.3	—
siemens	desigo_pxc22.1-e.d	>= V2.3 < V6.30.37	V6.30.37
siemens	desigo_pxc22.1-e.d_firmware	<= 2.3	—
siemens	desigo_pxc36.1-e.d	>= V2.3 < V6.30.37	V6.30.37

CWE-400 CWE-401