CVE-2022-30938: Buffer Overflow
First published: Tue Jul 12 2022(Updated: )
A vulnerability has been identified in EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.40), EN100 Ethernet module Modbus TCP variant (All versions), EN100 Ethernet module PROFINET IO variant (All versions). Affected applications contains a memory corruption vulnerability while parsing specially crafted HTTP packets to /txtrace endpoint manupulating a specific argument. This could allow an attacker to crash the affected application leading to a denial of service condition
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Siemens EN100 Ethernet Module DNP3 Firmware | ||
| siemens EN100 Ethernet module DNP3 | ||
| Siemens EN100 Ethernet Module IEC 104 | ||
| Siemens EN100 Ethernet Module IEC 61850 | <4.40 | |
| Siemens EN100 Ethernet Module Modbus TCP | ||
| Siemens EN100 Ethernet Module PROFINET IO |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2022-30938.
What is the severity of CVE-2022-30938?
The severity of CVE-2022-30938 is high with a severity value of 7.5.
Which Siemens products are affected by CVE-2022-30938?
The Siemens products affected by CVE-2022-30938 are EN100 Ethernet module DNP3 IP variant (All versions), EN100 Ethernet module IEC 104 variant (All versions), EN100 Ethernet module IEC 61850 variant (All versions < V4.40), EN100 Ethernet module Modbus TCP variant (All versions), and EN100 Ethernet module PROFINET IO variant (All versions).
Is Siemens En100 Ethernet Module vulnerable to CVE-2022-30938?
Siemens En100 Ethernet Module is not vulnerable to CVE-2022-30938.
How can I fix CVE-2022-30938?
To fix CVE-2022-30938, apply the necessary patches or firmware updates provided by Siemens.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/references
- agent/weakness
- agent/remedy
- agent/author
- agent/event
- agent/description
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/siemens
- canonical/siemens en100 ethernet module dnp3 firmware
- canonical/siemens en100 ethernet module dnp3
- canonical/siemens en100 ethernet module iec 104
- canonical/siemens en100 ethernet module iec 61850
- canonical/siemens en100 ethernet module modbus tcp
- canonical/siemens en100 ethernet module profinet io