rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-29842 Command Injection Vulnerability in Western Digital My Cloud devices
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before 5.26.119.


Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Western Digital
product: My Cloud OS 5
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Sam Thomas (@_s_n_t) of Pentest Ltd (@pentestltd) working with Trend Micro’s Zero Day Initiative
Published: 2023-05-10T20:53:19.844Z
CVE-2022-29843 Western Digital My Cloud OS 5 devices Command Injection Vulnerability
A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to execute code in the context of the root user.
Problem types: cwe_id: CWE-78
description: CWE-78 OS Command Injection
Affected products: vendor: Western Digital
product: My Cloud
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.2
baseSeverity: MEDIUM
Credits: lang: en
value: rskvp93 and biennd4 (from VcsLab of Viettel Cyber Security) working with Trend Micro Zero Day Initiative
Published: 2023-01-25T00:00:00.000Z
CVE-2022-29844 Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp
A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. This could lead to a full NAS compromise and would give remote execution capabilities to the attacker.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Western Digital
product: My Cloud
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
baseScore: 6.7
baseSeverity: MEDIUM
Credits: lang: en
value: Luca MORO (@johncool__) - moro.luca@gmail.comworking with Trend Micro Zero Day Initiative
Published: 2023-01-25T00:00:00.000Z
CVE-2022-29845 
In Progress Ipswitch WhatsUp Gold 21.1.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read the contents of a local file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:55:49.000Z
CVE-2022-29846 
In Progress Ipswitch WhatsUp Gold 16.1 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to obtain the WhatsUp Gold installation serial number.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:55:55.000Z
CVE-2022-29847 
In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:56:00.000Z
CVE-2022-29848 
In Progress Ipswitch WhatsUp Gold 17.0.0 through 21.1.1, and 22.0.0, it is possible for an authenticated user to invoke an API transaction that would allow them to read sensitive operating-system attributes from a host that is accessible by the WhatsUp Gold system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T17:56:07.000Z
CVE-2022-29849 
In Progress OpenEdge before 11.7.14 and 12.x before 12.2.9, certain SUID binaries within the OpenEdge application were susceptible to privilege escalation. If exploited, a local attacker could elevate their privileges and compromise the affected system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-01T23:23:33.000Z
CVE-2022-29850 
Various Lexmark products through 2022-04-27 allow an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-25T23:11:48.000Z
CVE-2022-29851 
documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-24T20:35:00.000Z
CVE-2022-29852 
OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-29853 
OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-26T00:00:00.000Z
CVE-2022-29854 
A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-13T13:12:13.000Z
CVE-2022-29855 
Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-11T19:12:48.000Z
CVE-2022-29856 
A hardcoded cryptographic key in Automation360 22 allows an attacker to decrypt exported RPA packages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-29T15:04:46.000Z
CVE-2022-29858 
Silverstripe silverstripe/assets through 1.10 is vulnerable to improper access control that allows protected images to be published by changing an existing image short code on website content.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-28T21:36:14.000Z
CVE-2022-29859 
component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-27T22:30:09.000Z
CVE-2022-29862 
An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T17:01:06.000Z
CVE-2022-29863 
OPC UA .NET Standard Stack 1.04.368 allows remote attacker to cause a crash via a crafted message that triggers excessive memory allocation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T17:09:49.000Z
CVE-2022-29864 
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to cause a server to crash via a large number of messages that trigger Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T17:05:56.000Z
CVE-2022-29865 
OPC UA .NET Standard Stack allows a remote attacker to bypass the application authentication check via crafted fake credentials.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T16:50:05.000Z
CVE-2022-29866 
OPC UA .NET Standard Stack 1.04.368 allows a remote attacker to exhaust the memory resources of a server via a crafted request that triggers Uncontrolled Resource Consumption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-06-16T17:39:39.000Z
CVE-2022-29868 
1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate secrets from 1Password provided that 1Password is running and is unlocked. Affected secrets include vault items and derived values used for signing in to 1Password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-05-09T18:34:50.000Z
CVE-2022-29869 
cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-04-28T00:00:00.000Z
CVE-2022-29871 
Improper access control in the Intel(R) CSME software installer before version 2239.3.7.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) CSME software installer
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.7
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-08-11T02:36:56.839Z
CVE-2022-29872 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow an authenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.
Problem types: cwe_id: CWE-141
description: CWE-141: Improper Neutralization of Parameter/Argument Delimiters
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2022-05-10T09:47:15.000Z
CVE-2022-29873 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. This could allow an unauthenticated attacker to set the device to a denial of service state or to control the program counter and, thus, execute arbitrary code on the device.
Problem types: cwe_id: CWE-141
description: CWE-141: Improper Neutralization of Parameter/Argument Delimiters
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 9.8
baseSeverity: CRITICAL
Published: 2022-05-10T09:47:16.000Z
CVE-2022-29874 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via HTTP. This could allow an unauthenticated attacker to capture the traffic and interfere with the functionality of the device.
Problem types: cwe_id: CWE-319
description: CWE-319: Cleartext Transmission of Sensitive Information
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2022-05-10T09:47:18.000Z
CVE-2022-29875 
A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions < VA40 SP2), SOMATOM X.cite (All versions < VA30 SP5 or VA40 SP2), SOMATOM X.creed (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.All (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Now (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Open Pro (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Sim (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Top (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Up (All versions < VA30 SP5 or VA40 SP2), Symbia E/S (All VB22 versions < VB22A-UD03), Symbia Evo (All VB22 versions < VB22A-UD03), Symbia Intevo (All VB22 versions < VB22A-UD03), Symbia T (All VB22 versions < VB22A-UD03), Symbia.net (All VB22 versions < VB22A-UD03), syngo.via VB10 (All versions), syngo.via VB20 (All versions), syngo.via VB30 (All versions), syngo.via VB40 (All versions < VB40B HF06), syngo.via VB50 (All versions), syngo.via VB60 (All versions < VB60B HF02). The application deserialises untrusted data without sufficient validations that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system if ports 32912/tcp or 32914/tcp are reachable.
Problem types: cwe_id: CWE-502
description: CWE-502: Deserialization of Untrusted Data
Affected products: vendor: Siemens
product: Biograph Horizon PET/CT Systems
vendor: Siemens
product: MAGNETOM Family
vendor: Siemens
product: MAMMOMAT Revelation
vendor: Siemens
product: NAEOTOM Alpha
vendor: Siemens
product: SOMATOM X.cite
vendor: Siemens
product: SOMATOM X.creed
vendor: Siemens
product: SOMATOM go.All
vendor: Siemens
product: SOMATOM go.Now
vendor: Siemens
product: SOMATOM go.Open Pro
vendor: Siemens
product: SOMATOM go.Sim
vendor: Siemens
product: SOMATOM go.Top
vendor: Siemens
product: SOMATOM go.Up
vendor: Siemens
product: Symbia E/S
vendor: Siemens
product: Symbia Evo
vendor: Siemens
product: Symbia Intevo
vendor: Siemens
product: Symbia T
vendor: Siemens
product: Symbia.net
vendor: Siemens
product: syngo.via VB10
vendor: Siemens
product: syngo.via VB20
vendor: Siemens
product: syngo.via VB30
vendor: Siemens
product: syngo.via VB40
vendor: Siemens
product: syngo.via VB50
vendor: Siemens
product: syngo.via VB60
Published: 2022-06-01T09:50:11.000Z
CVE-2022-29876 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provided argument is directly reflected in the web server response. This could allow an unauthenticated attacker to perform reflected XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
baseScore: 7.1
baseSeverity: HIGH
Published: 2022-05-10T09:47:19.000Z
CVE-2022-29877 
A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00), SICAM P855 (All versions < V3.00). Affected devices allow unauthenticated access to the web interface configuration area. This could allow an attacker to extract internal configuration details or to reconfigure network settings. However, the reconfigured settings cannot be activated unless the role of an authenticated administrator user.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P850
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
vendor: Siemens
product: SICAM P855
Published: 2022-05-10T09:47:21.000Z
CVE-2022-29878 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted challenge-response communication. An unauthenticated attacker could capture a valid challenge-response pair generated by a legitimate user, and request the webpage repeatedly to wait for the same challenge to reappear for which the correct response is known. This could allow the attacker to access the management interface of the device.
Problem types: cwe_id: CWE-294
description: CWE-294: Authentication Bypass by Capture-replay
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
baseScore: 7.5
baseSeverity: HIGH
Published: 2022-05-10T09:47:22.000Z
CVE-2022-29879 
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow authenticated users to access critical device information.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Published: 2022-05-10T09:47:23.000Z
CVE-2022-29880 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration interface. This could allow an authenticated attacker to place persistent XSS attacks to perform arbitrary actions in the name of a logged user which accesses the affected views.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-05-10T09:47:25.000Z
CVE-2022-29881 
A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access protection for certain internal developer views. This could allow unauthenticated users to extract internal configuration details.
Problem types: cwe_id: CWE-306
description: CWE-306: Missing Authentication for Critical Function
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2022-05-10T09:47:26.000Z
CVE-2022-29882 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker could take advantage of this situation to store an XSS attack, which could - when a legitimate user accesses the error logs - perform arbitrary actions in the name of the user.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
baseScore: 7.1
baseSeverity: HIGH
Published: 2022-05-10T09:47:28.000Z
CVE-2022-29883 
A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web interface. This could allow an attacker to delete log files without authentication.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Siemens
product: SICAM T
default_status: unknown
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2022-05-10T09:47:29.000Z
CVE-2022-29884 
A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions < CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions < CPC80 V16.30), CP-8021 MASTER MODULE (All versions < CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions < CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.
Problem types: cwe_id: CWE-772
description: CWE-772: Missing Release of Resource after Effective Lifetime
Affected products: vendor: Siemens
product: CP-8000 MASTER MODULE WITH I/O -25/+70°C
vendor: Siemens
product: CP-8000 MASTER MODULE WITH I/O -40/+70°C
vendor: Siemens
product: CP-8021 MASTER MODULE
vendor: Siemens
product: CP-8022 MASTER MODULE WITH GPRS
Published: 2022-07-12T10:06:40.000Z