Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2017-2659 State: PUBLISHED Published: 2019-03-20T20:44:51 Last Updated: 2024-08-05T14:02:07.018Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: [UNKNOWN] Products: dropbear Problem Types: CWE-209 Description: It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2659 - https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2659 - https://secure.ucc.asn.au/hg/dropbear/rev/d7784616409a#l1.86
CVE ID: CVE-2017-2660 State: REJECTED Published: 2019-03-26T17:44:53 Last Updated: 2019-03-26T17:44:53 Description: No description available.
CVE ID: CVE-2017-2661 State: PUBLISHED Published: 2018-03-12T15:00:00Z Last Updated: 2024-09-16T17:28:02.146Z Vendors: ClusterLabs Products: pcs Problem Types: CWE-79 Description: ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ClusterLabs/pcs/commit/1874a769b5720ae5430f10c6cedd234430bc703f - https://bugzilla.redhat.com/show_bug.cgi?id=1428948
CVE ID: CVE-2017-2662 State: PUBLISHED Published: 2018-08-22T16:00:00 Last Updated: 2024-08-05T14:02:07.107Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: The Foreman Project Products: foreman katello plugin Problem Types: CWE-862 Description: A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662 - https://projects.theforeman.o
ogram Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662 - https://projects.theforeman.org/issues/18838
CVE ID: CVE-2017-2663 State: PUBLISHED Published: 2018-07-27T20:00:00 Last Updated: 2024-08-05T14:02:07.221Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: Red Hat Products: subscription-manager Problem Types: CWE-270 Description: It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and com.redhat.RHSM1.Config.Set methods. An unprivileged local attacker could use these methods to gain access to private information, or launch a privilege escalation attack. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97015 - https://github.com/
ional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97015 - https://github.com/candlepin/subscription-manager/commit/2aa48ef65 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2663
CVE ID: CVE-2017-2664 State: PUBLISHED Published: 2018-07-26T14:00:00 Last Updated: 2024-08-05T14:02:07.550Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Red Hat Products: CloudForms Problem Types: CWE-284 Description: CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:3484 - http://www.securityfocus.com/bid/100148
gram Container: References: - https://access.redhat.com/errata/RHSA-2017:3484 - http://www.securityfocus.com/bid/100148 - https://access.redhat.com/errata/RHSA-2017:1758 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2664
CVE ID: CVE-2017-2665 State: PUBLISHED Published: 2018-07-06T13:00:00 Last Updated: 2024-08-05T14:02:07.257Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: [UNKNOWN] Products: rhscon-core Problem Types: CWE-522 Description: The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user. Any local user who has access to system running skyring service will be able to get password in plain text. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97612 - https://bugzilla.redhat.com/sh
st Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97612 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2665
CVE ID: CVE-2017-2666 State: PUBLISHED Published: 2018-07-27T14:00:00 Last Updated: 2024-08-05T14:02:07.176Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: [UNKNOWN] Products: undertow Problem Types: CWE-444 Description: It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own.
er could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1411 - http://rhn.redhat.com/errata/RHSA-2017-1409.html - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2666 - https://www.debian.org/security/2017/dsa-3906 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2017:1410 - https://access.redhat.com/errata/RHSA-2017:1412 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - http://www.securityfocus.com/bid/98966 - https://access.
A-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - http://www.securityfocus.com/bid/98966 - https://access.redhat.com/errata/RHSA-2017:3454
CVE ID: CVE-2017-2667 State: PUBLISHED Published: 2018-03-12T15:00:00Z Last Updated: 2024-08-05T14:02:07.434Z Vendors: Foreman Products: Hammer CLI Problem Types: CWE-345 Description: Hammer CLI, a CLI utility for Foreman, before version 0.10.0, did not explicitly set the verify_ssl flag for apipie-bindings that disable it by default. As a result the server certificates are not checked and connections are prone to man-in-the-middle attacks. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=1436262 - https://access.redhat.com/errata/RHSA-2018:0336 - http://projects.theforeman.org/issues/19033 - http://www.securityfocus.com/bid/97153
CVE ID: CVE-2017-2668 State: PUBLISHED Published: 2018-06-22T13:00:00 Last Updated: 2024-08-05T14:02:07.340Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: 389-ds-base Problem Types: CWE-119 Description: 389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0920 - https://bugzilla.redhat.com/show_
CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:0920 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2668 - https://pagure.io/389-ds-base/issue/49220 - http://www.securityfocus.com/bid/97524 - https://access.redhat.com/errata/RHSA-2017:0893
CVE ID: CVE-2017-2669 State: PUBLISHED Published: 2018-06-21T13:00:00 Last Updated: 2024-08-05T14:02:06.877Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: [UNKNOWN] Products: dovecot Problem Types: CWE-20 Description: Dovecot before version 2.2.29 is vulnerable to a denial of service. When 'dict' passdb and userdb were used for user authentication, the username sent by the IMAP/POP3 client was sent through var_expand() to perform %variable expansion. Sending specially crafted %variable fields could result in excessive memory usage causing the process to crash (and restart), or excessive CPU usage causing all authentications to hang. Additional Analyst Notes:
e process to crash (and restart), or excessive CPU usage causing all authentications to hang. Additional Analyst Notes: - CVE Program Container: References: - https://dovecot.org/pipermail/dovecot-news/2017-April/000341.html - http://www.openwall.com/lists/oss-security/2017/04/11/1 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2669 - https://github.com/dovecot/core/commit/000030feb7a30f193197f1aab8a7b04a26b42735.patch - https://www.debian.org/security/2017/dsa-3828 - http://www.securityfocus.com/bid/97536
CVE ID: CVE-2017-2670 State: PUBLISHED Published: 2018-07-27T15:00:00 Last Updated: 2024-08-05T14:02:06.996Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: [UNKNOWN] Products: undertow Problem Types: CWE-835 Description: It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1411 - http://rhn.redhat.com/errata/RHSA-2017-1409.html - https://www.debian.org/security/2017/dsa-3906 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.
https://www.debian.org/security/2017/dsa-3906 - https://access.redhat.com/errata/RHSA-2017:3458 - https://access.redhat.com/errata/RHSA-2017:1410 - https://access.redhat.com/errata/RHSA-2017:1412 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2670 - https://access.redhat.com/errata/RHSA-2017:3455 - https://access.redhat.com/errata/RHSA-2017:3456 - https://access.redhat.com/errata/RHSA-2017:3454 - http://www.securityfocus.com/bid/98965
CVE ID: CVE-2017-2671 State: PUBLISHED Published: 2017-04-05T06:23:00 Last Updated: 2024-08-05T14:02:07.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ping_unhash function in net/ipv4/ping.c in the Linux kernel through 4.10.8 is too late in obtaining a certain lock and consequently cannot ensure that disconnect function calls are safe, which allows local users to cause a denial of service (panic) by leveraging access to the protocol value of IPPROTO_ICMP in a socket system call. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/97407 - https://github.com/torvalds/linux/commit/43a6684519ab0a6c52024b5e25322476cabad893 - http:
.securityfocus.com/bid/97407 - https://github.com/torvalds/linux/commit/43a6684519ab0a6c52024b5e25322476cabad893 - http://openwall.com/lists/oss-security/2017/04/04/8 - https://access.redhat.com/errata/RHSA-2017:2669 - https://access.redhat.com/errata/RHSA-2018:1854 - https://usn.ubuntu.com/3754-1/ - https://twitter.com/danieljiang0415/status/845116665184497664 - https://github.com/danieljiang0415/android_kernel_crash_poc - https://www.exploit-db.com/exploits/42135/ - https://access.redhat.com/errata/RHSA-2017:2077 - https://access.redhat.com/errata/RHSA-2017:1842 - https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/net/ipv4/ping.c?id=43a6684519ab0a6c52024b5e25322476cabad89
/git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/net/ipv4/ping.c?id=43a6684519ab0a6c52024b5e25322476cabad893
CVE ID: CVE-2017-2672 State: PUBLISHED Published: 2018-06-21T13:00:00 Last Updated: 2024-08-05T14:02:07.221Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: [UNKNOWN] Products: foreman Problem Types: CWE-312 Description: A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems. Additional Analyst Notes: - CVE Program Container: References: - https://projects.theforeman.org/issues/19169 - https://access.redhat.com/errata/RHSA-2018:0336 - http://www.securityfocus.c
ps://projects.theforeman.org/issues/19169 - https://access.redhat.com/errata/RHSA-2018:0336 - http://www.securityfocus.com/bid/97526 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2672
CVE ID: CVE-2017-2673 State: PUBLISHED Published: 2018-07-19T13:00:00 Last Updated: 2024-08-05T14:02:07.120Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: [UNKNOWN] Products: openstack-keystone Problem Types: CWE-863 Description: An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles. Additional Analyst Notes: - CVE Program Container: References: - http://seclists.org/oss-sec/2017/q2/125 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2673
ainer: References: - http://seclists.org/oss-sec/2017/q2/125 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2673 - https://bugs.launchpad.net/keystone/+bug/1677723 - https://access.redhat.com/errata/RHSA-2017:1461 - https://access.redhat.com/errata/RHSA-2017:1597 - http://www.securityfocus.com/bid/98032
CVE ID: CVE-2017-2674 State: PUBLISHED Published: 2018-07-27T18:00:00 Last Updated: 2024-08-05T14:02:07.305Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Red Hat Products: business-central Problem Types: CWE-20 Description: JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins. Additional Analyst Notes: - CVE Program Container: References: - https:/
efore showing to other users, including admins. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2017:1217 - https://access.redhat.com/errata/RHSA-2017:1218 - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2674 - http://www.securityfocus.com/bid/98390
CVE ID: CVE-2017-2675 State: PUBLISHED Published: 2017-04-06T15:00:00 Last Updated: 2024-08-05T14:02:07.317Z Vendors: Objective Development Software GmbH Products: Little Snitch Problem Types: unspecified Description: Little Snitch version 3.0 through 3.7.3 suffer from a local privilege escalation vulnerability in the installer part. The vulnerability is related to the installation of the configuration file "at.obdev.littlesnitchd.plist" which gets installed to /Library/LaunchDaemons. Additional Analyst Notes: - CVE Program Container: References: - https://www.obdev.at/products/littlesnitch/releasenotes.html - https://twitter.com/patrickwardle/status/849076615170711552
CVE ID: CVE-2017-2676 State: REJECTED Published: 2019-04-02T19:15:15 Last Updated: 2019-04-03T16:59:35 Description: No description available.
CVE ID: CVE-2017-2677 State: REJECTED Published: 2019-04-02T19:15:15 Last Updated: 2019-04-03T17:02:53 Description: No description available.
CVE ID: CVE-2017-2678 State: REJECTED Published: 2019-04-02T19:15:15 Last Updated: 2019-04-03T17:05:05 Description: No description available.
CVE ID: CVE-2017-2679 State: REJECTED Published: 2019-04-02T19:15:15 Last Updated: 2019-04-03T17:07:06 Description: No description available.
CVE ID: CVE-2017-2680 State: PUBLISHED Published: 2017-05-11T01:00:00 Last Updated: 2024-09-10T09:33:18.492Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Siemens Products: Development/Evaluation Kits for PROFINET IO: DK Standard Ethernet Controller, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200, Development/Evaluation Kits for PROFINET IO: EK-ERTEC 200P, Extension Unit 12" PROFINET, Extension Unit 15" PROFINET, Extension Unit 19" PROFINET, Extension Unit 22" PROFINET, IE/AS-i Link PN IO, IE/PB-Link (incl. SIPLUS NET variants), SCALANCE M-800 family (incl. S615, MUM-800 and RM1224), SCALANCE W-700 IEEE 802.11n family, SCALANCE X-200 family (inc
, SCALANCE M-800 family (incl. S615, MUM-800 and RM1224), SCALANCE W-700 IEEE 802.11n family, SCALANCE X-200 family (incl. SIPLUS NET variants), SCALANCE X-200IRT family (incl. SIPLUS NET variants), SCALANCE X-300 family (incl. X408 and SIPLUS NET variants), SCALANCE X408 family, SCALANCE X414, SCALANCE XM-400 family, SCALANCE XR-500 family, SIMATIC CM 1542-1, SIMATIC CM 1542SP-1, SIMATIC CP 1242-7 V2 (incl. SIPLUS variants), SIMATIC CP 1243-1 (incl. SIPLUS variants), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants), SIMATIC CP 1243-7 LTE US, SIMATIC CP 1243-8 IRC, SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants), SIMATIC CP 1543-1 (incl. SIPLUS va
243-7 LTE US, SIMATIC CP 1243-8 IRC, SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants), SIMATIC CP 1543-1 (incl. SIPLUS variants), SIMATIC CP 1543SP-1 (incl. SIPLUS variants), SIMATIC CP 1604, SIMATIC CP 1616, SIMATIC CP 1626, SIMATIC CP 343-1 (incl. SIPLUS variants), SIMATIC CP 343-1 Advanced (incl. SIPLUS variants), SIMATIC CP 343-1 Lean (incl. SIPLUS variants), SIMATIC CP 443-1 (incl. SIPLUS variants), SIMATIC CP 443-1 Advanced (incl. SIPLUS variants), SIMATIC CP 443-1 OPC UA, SIMATIC DK-16xx PN IO, SIMATIC ET 200AL IM 157-1 PN, SIMATIC ET 200M (incl. SIPLUS variants), SIMATIC ET 200MP IM 155-5 PN BA, SIMATIC ET 200MP IM 155-5 PN HF, SIMATIC ET 200MP IM 155-5 PN ST, SIMATIC ET 200pro IM 154
ATIC ET 200MP IM 155-5 PN BA, SIMATIC ET 200MP IM 155-5 PN HF, SIMATIC ET 200MP IM 155-5 PN ST, SIMATIC ET 200pro IM 154-3 PN HF, SIMATIC ET 200pro IM 154-4 PN HF, SIMATIC ET 200SP IM 155-6 PN BA, SIMATIC ET 200SP IM 155-6 PN HF, SIMATIC ET 200SP IM 155-6 PN HS, SIMATIC ET 200SP IM 155-6 PN ST, SIMATIC ET 200SP IM 155-6 PN ST BA, SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 4AO U/I 4xM12, SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12, SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12, SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 8xM
MATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12, SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12, SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12, SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12, SIMATIC ET200ecoPN: IO-Link Master, SIMATIC ET200S (incl. SIPLUS variants), SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels (incl. SIPLUS variants), SIMATIC MV420 SR-B, SIMATIC MV420 SR-B Body, SIMATIC MV420 SR-P, SIMATIC MV420 SR-P Body, SIMATIC MV440 HR, SIMATIC MV440 SR, SIMATIC MV440 UR, SIMATIC PN/PN Coupler (incl. SIPLUS NET variants), SIMATIC RF650R, SIMATIC RF680R, SIMATIC RF685R, SIMATIC S7-1200 CPU family (incl. SI
oupler (incl. SIPLUS NET variants), SIMATIC RF650R, SIMATIC RF680R, SIMATIC RF685R, SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-200 SMART, SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V6 CPU family (incl. SIPLUS variants), SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants), SIMATIC S7-410 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMATIC Teleservice Adapter IE Advanced, SIMATIC Teleservice Adapter IE Basic, SIMATIC Te
DC CP51M1, SIMATIC TDC CPU555, SIMATIC Teleservice Adapter IE Advanced, SIMATIC Teleservice Adapter IE Basic, SIMATIC Teleservice Adapter IE Standard, SIMATIC WinAC RTX 2010, SIMATIC WinAC RTX F 2010, SIMOCODE pro V PROFINET (incl. SIPLUS variants), SIMOTION, SIMOTION D4xx V4.4 for SINAMICS SM150i-2 w. PROFINET (incl. SIPLUS variants), SINAMICS DCM w. PN, SINAMICS DCP w. PN, SINAMICS G110M w. PN, SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants), SINAMICS G130 V4.7 w. PN, SINAMICS G130 V4.8 w. PN, SINAMICS G150 V4.7 w. PN, SINAMICS G150 V4.8 w. PN, SINAMICS GH150 V4.7 w. PROFINET, SINAMICS GL150 V4.7 w. PROFINET, SINAMICS GM150 V4.7 w. PROFINET, SINAMICS S110 w. PN, SINAMICS S120 prior to V
ROFINET, SINAMICS GL150 V4.7 w. PROFINET, SINAMICS GM150 V4.7 w. PROFINET, SINAMICS S110 w. PN, SINAMICS S120 prior to V4.7 w. PN (incl. SIPLUS variants), SINAMICS S120 V4.7 SP1 w. PN (incl. SIPLUS variants), SINAMICS S120 V4.7 w. PN (incl. SIPLUS variants), SINAMICS S120 V4.8 w. PN (incl. SIPLUS variants), SINAMICS S150 V4.7 w. PN, SINAMICS S150 V4.8 w. PN, SINAMICS SL150 V4.7.0 w. PROFINET, SINAMICS SL150 V4.7.4 w. PROFINET, SINAMICS SL150 V4.7.5 w. PROFINET, SINAMICS SM120 V4.7 w. PROFINET, SINAMICS V90 w. PN, SINUMERIK 828D V4.5 and prior, SINUMERIK 828D V4.7, SINUMERIK 840D sl V4.5 and prior, SINUMERIK 840D sl V4.7, SIPLUS ET 200MP IM 155-5 PN HF, SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL,
840D sl V4.5 and prior, SINUMERIK 840D sl V4.7, SIPLUS ET 200MP IM 155-5 PN HF, SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL, SIPLUS ET 200MP IM 155-5 PN ST, SIPLUS ET 200MP IM 155-5 PN ST TX RAIL, SIPLUS ET 200SP IM 155-6 PN HF, SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, SIPLUS ET 200SP IM 155-6 PN ST, SIPLUS ET 200SP IM 155-6 PN ST BA, SIPLUS ET 200SP IM 155-6 PN ST BA TX RAIL, SIPLUS ET 200SP IM 155-6 PN ST TX RAIL, SIRIUS ACT 3SU1 interface module PROFINET, SIRIUS Motor Starter M200D PROFINET, SIRIUS Soft Starter 3RW44 PN, SITOP PSU8600 PROFINET, SITOP UPS1600 PROFINET (incl. SIPLUS variants), Softnet PROFINET IO for PC-based Windows systems Problem Types: CWE-400 Description: Specially crafted
IPLUS variants), Softnet PROFINET IO for PC-based Windows systems Problem Types: CWE-400 Description: Specially crafted PROFINET DCP broadcast packets could cause a denial of service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - http://www.securitytracker.com/id/1038463 - http://www.securityfocus.com/bid/98369 - https://cert-portal.siemens.com/productcert/pdf/ssa-546832.pdf - https://ics-cert.us-cert.gov/advisories/ICSA-18-023-02 - https://cert-portal.siemens.com/productcert/pdf/ssa-293562
df - https://ics-cert.us-cert.gov/advisories/ICSA-18-023-02 - https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf - https://www.siemens.com/cert/pool/cert/siemens_security_advisory_ssa-284673.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-284673.pdf - https://cert-portal.siemens.com/productcert/html/ssa-293562.html - https://cert-portal.siemens.com/productcert/html/ssa-284673.html - https://cert-portal.siemens.com/productcert/html/ssa-546832.html