Know every vulnerabilitybefore it knows you.
DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.
- Feiten
Siemens heeft kwetsbaarheden verholpen in diverse producten, zoals SCALANCE, SICAM, Tecnomatix, SITOP en PowerSys.
- Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van beveiligingsmaatregel
- (Remote) code execution (Administrator/Root rechten)
- (Remote) code execution (Gebruikersrechten)
- Toegang tot systeemgegevens
- Verhoogde gebruikersrechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
- Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
- Kans
medium
- Schade
high
- CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-121
Stack-based Buffer Overflow
- CWE-122
Heap-based Buffer Overflow
- CWE-1220
Insufficient Granularity of Access Control
- CWE-123
Write-what-where Condition
- CWE-125
Out-of-bounds Read
- CWE-1333
Inefficient Regular Expression Complexity
- CWE-170
Improper Null Termination
- CWE-190
Integer Overflow or Wraparound
- CWE-191
Integer Underflow (Wrap or Wraparound)
- CWE-20
Improper Input Validation
- CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
- CWE-269
Improper Privilege Management
- CWE-287
Improper Authentication
- CWE-295
Improper Certificate Validation
- CWE-311
Missing Encryption of Sensitive Data
- CWE-319
Cleartext Transmission of Sensitive Information
- CWE-321
Use of Hard-coded Cryptographic Key
- CWE-325
Missing Cryptographic Step
- CWE-326
Inadequate Encryption Strength
- CWE-328
Use of Weak Hash
- CWE-330
Use of Insufficiently Random Values
- CWE-349
Acceptance of Extraneous Untrusted Data With Trusted Data
- CWE-352
Cross-Site Request Forgery (CSRF)
- CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-379
Creation of Temporary File in Directory with Insecure Permissions
- CWE-400
Uncontrolled Resource Consumption
- CWE-401
Missing Release of Memory after Effective Lifetime
- CWE-404
Improper Resource Shutdown or Release
- CWE-415
Double Free
- CWE-416
Use After Free
- CWE-476
NULL Pointer Dereference
- CWE-522
Insufficiently Protected Credentials
- CWE-567
Unsynchronized Access to Shared Data in a Multithreaded Context
- CWE-613
Insufficient Session Expiration
- CWE-614
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- CWE-664
Improper Control of a Resource Through its Lifetime
- CWE-667
Improper Locking
- CWE-704
Incorrect Type Conversion or Cast
- CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-749
Exposed Dangerous Method or Function
- CWE-754
Improper Check for Unusual or Exceptional Conditions
- CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-787
Out-of-bounds Write
- CWE-833
Deadlock
- CWE-834
Excessive Iteration
- CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-94
Improper Control of Generation of Code ('Code Injection')
Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.
Checkout DevGuard