Description (CNA)
A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO EN Fire Panel FC72x IP7 (All versions < IP7 SR5), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions < V3.0.6602), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.0.5016), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions < V3.2.6601), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.2.5015), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions < MP8), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions < MP6 SR3), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions < MP7 SR5), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions < V3.0.6602), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.2.5015), Sinteso Mobile (All versions < V3.0.0). The network communication library in affected systems does not validate the length of certain X.509 certificate attributes which might result in a stack-based buffer overflow. This could allow an unauthenticated remote attacker to execute code on the underlying operating system with root privileges.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Siemens / Cerberus PRO EN Engineering Tool | affected 0 before IP8 |
| Siemens / Cerberus PRO EN Fire Panel FC72x IP6 | affected 0 before IP6 SR3 |
| Siemens / Cerberus PRO EN Fire Panel FC72x IP7 | affected 0 before IP7 SR5 |
| Siemens / Cerberus PRO EN X200 Cloud Distribution IP7 | affected 0 before V3.0.6602 |
| Siemens / Cerberus PRO EN X200 Cloud Distribution IP8 | affected 0 before V4.0.5016 |
| Siemens / Cerberus PRO EN X300 Cloud Distribution IP7 | affected 0 before V3.2.6601 |
| Siemens / Cerberus PRO EN X300 Cloud Distribution IP8 | affected 0 before V4.2.5015 |
| Siemens / Cerberus PRO UL Compact Panel FC922/924 | affected 0 before MP4 |
| Siemens / Cerberus PRO UL Engineering Tool | affected 0 before MP4 |
| Siemens / Cerberus PRO UL X300 Cloud Distribution | affected 0 before V4.3.0001 |
| Siemens / Desigo Fire Safety UL Compact Panel FC2025/2050 | affected 0 before MP4 |
| Siemens / Desigo Fire Safety UL Engineering Tool | affected 0 before MP4 |
| Siemens / Desigo Fire Safety UL X300 Cloud Distribution | affected 0 before V4.3.0001 |
| Siemens / Sinteso FS20 EN Engineering Tool | affected 0 before MP8 |
| Siemens / Sinteso FS20 EN Fire Panel FC20 MP6 | affected 0 before MP6 SR3 |
| Siemens / Sinteso FS20 EN Fire Panel FC20 MP7 | affected 0 before MP7 SR5 |
| Siemens / Sinteso FS20 EN X200 Cloud Distribution MP7 | affected 0 before V3.0.6602 |
| Siemens / Sinteso FS20 EN X200 Cloud Distribution MP8 | affected 0 before V4.0.5016 |
| Siemens / Sinteso FS20 EN X300 Cloud Distribution MP7 | affected 0 before V3.2.6601 |
| Siemens / Sinteso FS20 EN X300 Cloud Distribution MP8 | affected 0 before V4.2.5015 |
| Siemens / Sinteso Mobile | affected 0 before V3.0.0 |
CWE
CWE-120
References
- https://cert-portal.siemens.com/productcert/html/ssa-225840.html
- https://cert-portal.siemens.com/productcert/html/ssa-953710.html
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.