CVE-2024-22041
published 2024-03-12CVE-2024-22041: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN…
PriorityP343high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.51%
39.5th percentile
A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN Fire Panel FC72x IP7 (All versions), Cerberus PRO EN Fire Panel FC72x IP8 (All versions < IP8 SR4), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.3.5618), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.3.5617), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions), Sinteso FS20 EN Fire Panel FC20 MP8 (All versions < MP8 SR4), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.3.5618), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.3.5617), Sinteso Mobile (All versions). The network communication library in affected systems improperly handles memory buffers when parsing X.509 certificates.
This could allow an unauthenticated remote attacker to crash the network service.
Affected
23 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| siemens | cerberus_pro_en_engineering_tool | < * | * |
| siemens | cerberus_pro_en_fire_panel_fc72x_ip6 | < * | * |
| siemens | cerberus_pro_en_fire_panel_fc72x_ip7 | < * | * |
| siemens | cerberus_pro_en_fire_panel_fc72x_ip8 | < IP8 SR4 | IP8 SR4 |
| siemens | cerberus_pro_en_x200_cloud_distribution_ip7 | < * | * |
| siemens | cerberus_pro_en_x200_cloud_distribution_ip8 | < V4.3.5618 | V4.3.5618 |
| siemens | cerberus_pro_en_x300_cloud_distribution_ip7 | < * | * |
| siemens | cerberus_pro_en_x300_cloud_distribution_ip8 | < V4.3.5617 | V4.3.5617 |
| siemens | cerberus_pro_ul_compact_panel_fc922_924 | < MP4 | MP4 |
| siemens | cerberus_pro_ul_engineering_tool | < MP4 | MP4 |
| siemens | cerberus_pro_ul_x300_cloud_distribution | < V4.3.0001 | V4.3.0001 |
| siemens | desigo_fire_safety_ul_compact_panel_fc2025_2050 | < MP4 | MP4 |
| siemens | desigo_fire_safety_ul_engineering_tool | < MP4 | MP4 |
| siemens | desigo_fire_safety_ul_x300_cloud_distribution | < V4.3.0001 | V4.3.0001 |
| siemens | sinteso_fs20_en_engineering_tool | < * | * |
| siemens | sinteso_fs20_en_fire_panel_fc20_mp6 | < * | * |
| siemens | sinteso_fs20_en_fire_panel_fc20_mp7 | < * | * |
| siemens | sinteso_fs20_en_fire_panel_fc20_mp8 | < MP8 SR4 | MP8 SR4 |
| siemens | sinteso_fs20_en_x200_cloud_distribution_mp7 | < * | * |
| siemens | sinteso_fs20_en_x200_cloud_distribution_mp8 | < V4.3.5618 | V4.3.5618 |
| siemens | sinteso_fs20_en_x300_cloud_distribution_mp7 | < * | * |
| siemens | sinteso_fs20_en_x300_cloud_distribution_mp8 | < V4.3.5617 | V4.3.5617 |
| siemens | sinteso_mobile | < * | * |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2f92-gfhp-7pv8: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x (All versions < IP8 SR4), Cer
ghsa_unreviewed·2024-03-12
CVE-2024-22041 [HIGH] CWE-119 GHSA-2f92-gfhp-7pv8: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x (All versions < IP8 SR4), Cer
A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x (All versions < IP8 SR4), Cerberus PRO EN X200 Cloud Distribution (All versions < V4.3.5618), Cerberus PRO EN X300 Cloud Distribution (All versions < V4.3.5617), Sinteso FS20 EN Engineering Tool (All versions), Sinteso FS20 EN Fire Panel FC20 (All versions < MP8 SR4), Sinteso FS20 EN X200 Cloud Distribution (All versions < V4.3.5618), Sinteso FS20 EN X300 Cloud Distribution (All versions < V4.3.5617), Sinteso Mobile (All versions). The network communication library in affected systems improperly handles memory buffers when parsing X.509 certificates.
This could allow an unauthenticated remote attacker to crash the network service.
CISA ICS
Siemens Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems
cisa_ics·2024-05-16·CVSS 10.0
[CRITICAL] Siemens Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems
ICS Advisory
##
Siemens Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems
Release DateMay 16, 2024
Alert CodeICSA-24-137-12
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v3 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Cerberus PRO UL and Desigo Fire Safety UL
- Vulnerabilities: Classic Buffer Overflow, Out-of-bounds Read, Improper Restriction of Operations within the Bounds of a Memory Buffe
CISA ICS
Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems
cisa_ics·2024-03-14
Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems
ICS Advisory
##
Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems
Release DateMarch 14, 2024
Alert CodeICSA-24-074-09
As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).
View CSAF
## 1. EXECUTIVE SUMMARY
- CVSS v4 10.0
- ATTENTION: Exploitable remotely/low attack complexity
- Vendor: Siemens
- Equipment: Sinteso EN, Cerberus PRO EN Fire Protection Systems
- Vulnerabilities: Classic Buffer Overflow, Out-of-bounds Read, Improper Restriction of Operations within the Bounds of a Memory Buffer
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-03-12
Published