Rewterz Threat Advisory – ICS: Multiple Siemens Products Vulnerabilities

Rewterz Threat Alert – Donot APT Group – Active IOCs

March 17, 2024

Rewterz Threat Advisory – Multiple Microsoft Products Vulnerabilities

March 18, 2024

Rewterz Threat Advisory – ICS: Multiple Siemens Products Vulnerabilities

Severity

High

Analysis Summary

CVE-2024-22041 CVSS:7.5

Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems is vulnerable to a denial of service, caused by an out-of-bounds read flaw. By sending a specially crafted request, a remote attacker could exploit this vulnerability to crash the network service

CVE-2024-22040 CVSS:7.5

CVE-2024-22039 CVSS:10

Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems is vulnerable to a classic buffer overflow, caused by improper bounds checking. By sending a specially crafted request, a remote attacker could overflow a buffer and execute arbitrary code on the system.

CVE-2024-22044 CVSS:7.5

Siemens SENTRON is vulnerable to a denial of service, caused by containing a hidden functionality. By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service.

CVE-2024-22045 CVSS:7.6

Siemens SINEMA Remote Connect Client could allow a remote authenticated attacker to obtain sensitive information, caused by insertion of sensitive information into externally-accessible file or directory. By sending a specially crafted request, a remote attacker could <exploit this vulnerability to obtain sensitive information.

CVE-2022-32257 CVSS:9.8

Siemens SINEMA Remote Connect Server could allow a remote attacker to execute arbitrary code on the system, caused by improper access control. By sending a specially crafted request, an attacker could exploit this vulnerability to access to resources and potentially lead to code execution.

CVE-2020-23064 CVSS:6.1

Siemens SINEMA Remote Connect Server is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to inject malicious script into a Web page which would be executed in a victims Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victims cookie-based authentication credentials.

CVE-2024-21483 CVSS:4.6

Siemens SENTRON 7KM PAC3x20 could allow a local attacker to obtain sensitive information, caused by improper access control. AN attacker could exploit this vulnerability to obtain sensitive information with physical access.