CVE-2022-24282: High severity siemens sinec nms vulnerability

Q: What is the CWE of CVE-2022-24282?

The CWE of CVE-2022-24282 is 502.

Q: How can I fix CVE-2022-24282?

Apply the latest security patches or updates provided by Siemens to fix CVE-2022-24282.

Published Mar 8, 2022

Updated

A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges.

Affected Software

1 affected component

Siemens Sinec Network Management System>=1.0.3

Event History

Mar 8, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2022-24282.

What is the severity of CVE-2022-24282?

The severity of CVE-2022-24282 is high with a CVSS score of 7.2.

Which software versions are affected by CVE-2022-24282?

All versions of SINEC NMS >= V1.0.3 < V2.0, SINEC NMS < V1.0.3, and SINEMA Server V14 are affected.

What is the CWE of CVE-2022-24282?

The CWE of CVE-2022-24282 is 502.

How can I fix CVE-2022-24282?