by Kastro CVE-2022-37434
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP — zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field.
Description · from the CVE record
zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE: only applications that call inflateGetHeader are affected. Some common applications bundle the affected zlib source code but may be unable to call inflateGetHeader (e.g., see the nodejs/node reference).
Affected
ProductAffectedFixed inSource
n/asee advisory–CNA
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFPV3.1.0 – < V3.1.5V3.1.5siemens-SADP
RUGGEDCOM ROX MX5000< V2.17.0V2.17.0siemens-SADP
RUGGEDCOM ROX MX5000RE< V2.17.0V2.17.0siemens-SADP
RUGGEDCOM ROX RX1400< V2.17.0V2.17.0siemens-SADP
RUGGEDCOM ROX RX1500< V2.17.0V2.17.0siemens-SADP
RUGGEDCOM ROX RX1501< V2.17.0V2.17.0siemens-SADP
RUGGEDCOM ROX RX1510< V2.17.0V2.17.0siemens-SADP
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial