Exposure of Encrypted Passwords in Siemens Devices
CVE-2022-46142
5.7MEDIUM
Key Information:
- Vendor
- Siemens
- Status
- Vendor
- CVE Published:
- 13 December 2022
Summary
A security vulnerability exists in Siemens devices that allows attackers with physical access to extract and decrypt CLI user passwords stored in flash memory. This could lead to unauthorized access to device management functions, highlighting the importance of securing physical access to devices.
Affected Version(s)
RUGGEDCOM RM1224 LTE(4G) EU All versions < V7.2
RUGGEDCOM RM1224 LTE(4G) NAM All versions < V7.2
SCALANCE M804PB All versions < V7.2
References
CVSS V3.1
Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved