Arbitrary Code Execution Vulnerability in Siemens Networking Products
CVE-2022-34821

8.8HIGH

Key Information:

Vendor
Siemens
Status
Ruggedcom Rm1224 Lte(4g) Eu
Ruggedcom Rm1224 Lte(4g) Nam
Scalance M804pb
Scalance M812-1 Adsl-router
Vendor
CVE Published:
12 July 2022

Summary

A vulnerability exists in certain Siemens devices that allows an attacker to execute arbitrary code with elevated privileges by injecting malicious commands into specific OpenVPN configuration options. This can lead to significant security risks, potentially allowing unauthorized access to sensitive systems and data.

Affected Version(s)

RUGGEDCOM RM1224 LTE(4G) EU 0

RUGGEDCOM RM1224 LTE(4G) NAM 0

SCALANCE M804PB 0

References

https://cert-portal.siemens.com/productcert/pdf/ssa-51737...
https://cert-portal.siemens.com/productcert/pdf/ssa-41356...
https://cert-portal.siemens.com/productcert/html/ssa-5173...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.