PT-2022-3193 · Siemens · Simatic Cp 442-1 Rna+1

Published 2022-03-22 · Updated 2022-06-01 · CVE-2022-27640

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC CP 442-1 RNA versions prior to V1.5.18 SIMATIC CP 443-1 RNA versions prior to V1.5.18

Description The issue is related to the improper handling of excessive ARP broadcast requests, which could allow an attacker to create a denial of service condition by performing ARP storming attacks. This can cause the device to reboot.

Recommendations For SIMATIC CP 442-1 RNA versions prior to V1.5.18, update to version V1.5.18 or later. For SIMATIC CP 443-1 RNA versions prior to V1.5.18, update to version V1.5.18 or later.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2022-03878

CVE-2022-27640

Affected Products

Simatic Cp 442-1 Rna

Simatic Cp 443-1 Rna

References · 6

• https://osv.dev/vulnerability/CVE-2022-27640 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27640 · Security Note
• https://bdu.fstec.ru/vul/2022-03878 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-480937.pdf · Vendor Advisory
• https://t.me/cibsecurity/43044 · Telegram Post
• https://vuldb.com/ru/?id.200445 · Note