Memory Corruption in EN100 Ethernet Modules by Siemens
CVE-2022-30938

7.5HIGH

Key Information:

Vendor

Siemens
Status
En100 Ethernet Module Dnp3 Ip Variant
En100 Ethernet Module Iec 104 Variant
En100 Ethernet Module Iec 61850 Variant
En100 Ethernet Module Modbus Tcp Variant
Vendor
CVE Published:
12 July 2022

What is CVE-2022-30938?

A vulnerability exists within Siemens' EN100 Ethernet modules that can be exploited through specifically crafted HTTP packets. When an attacker targets the /txtrace endpoint and manipulates a particular argument, it results in a memory corruption issue. This can cause the affected application to crash, leading to a denial of service condition, impacting the availability of the services relying on these modules.

Affected Version(s)

EN100 Ethernet module DNP3 IP variant All versions

EN100 Ethernet module IEC 104 variant All versions

EN100 Ethernet module IEC 61850 variant All versions < V4.40

References

https://cert-portal.siemens.com/productcert/pdf/ssa-86533...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.