PT-2022-19892 · Unknown · Cp-8000 Master Module With I/O -25/+70°C+3

Published 2022-07-12 · Updated 2022-07-19 · CVE-2022-29884

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions CP-8000 MASTER MODULE WITH I/O -25/+70°C versions prior to CPC80 V16.30 CP-8000 MASTER MODULE WITH I/O -40/+70°C versions prior to CPC80 V16.30 CP-8021 MASTER MODULE versions prior to CPC80 V16.30 CP-8022 MASTER MODULE WITH GPRS versions prior to CPC80 V16.30

Description A vulnerability has been identified in certain devices when using the HTTPS server under specific conditions. Affected devices do not properly free resources, which could allow an unauthenticated remote attacker to put the device into a denial of service condition.

Recommendations For CP-8000 MASTER MODULE WITH I/O -25/+70°C versions prior to CPC80 V16.30, update to version CPC80 V16.30 or later. For CP-8000 MASTER MODULE WITH I/O -40/+70°C versions prior to CPC80 V16.30, update to version CPC80 V16.30 or later. For CP-8021 MASTER MODULE versions prior to CPC80 V16.30, update to version CPC80 V16.30 or later. For CP-8022 MASTER MODULE WITH GPRS versions prior to CPC80 V16.30, update to version CPC80 V16.30 or later. As a temporary workaround, consider restricting access to the HTTPS server until a patch is available.

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2022-29884

Affected Products

Cp-8000 Master Module With I/O -25/+70°C

Cp-8000 Master Module With I/O -40/+70°C

Cp-8021 Master Module

Cp-8022 Master Module With Gprs

References · 4

• https://osv.dev/vulnerability/CVE-2022-29884 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-491621.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29884 · Security Note
• https://t.me/cibsecurity/45968 · Telegram Post