CVE-2012-1802

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2012-1802
Buffer overflow in the embedded web server on the Siemens Scalance X Industrial Ethernet switch X414-3E before 3.7.1, X308-2M before 3.7.2, X-300EEC before 3.7.2, XR-300 before 3.7.2, and X-300 before 3.7.2 allows remote attackers to cause a denial of service (device reboot) or possibly execute arbitrary code via a malformed URL.

7.8 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 10.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://osvdb.org/81032
http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-130874.pdf Vendor Advisory
http://www.us-cert.gov/control_systems/pdf/ICSA-12-102-04.pdf US Government Resource
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:siemens:scalance_x414-3e_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:1.2.2:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:2.1.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:2.3.3:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:3.0.2:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:3.3.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x414-3e_firmware:3.4.0:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x414-3e:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
OR cpe:2.3:a:siemens:scalance_x308-2m_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x308-2m_firmware:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x308-2m_firmware:3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x308-2m_firmware:3.5.2:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x308-2m:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
OR cpe:2.3:a:siemens:scalance_x-300eec_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300eec_firmware:3.5.0:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x-300eec:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
OR cpe:2.3:a:siemens:scalance_xr-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_xr-300_firmware:3.1.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_xr-300_firmware:3.5.0:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_xr-300:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
OR cpe:2.3:a:siemens:scalance_x-300_firmware:*:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300_firmware:2.2.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300_firmware:2.3.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300_firmware:3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300_firmware:3.3.1:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300_firmware:3.5.0:*:*:*:*:*:*:*
cpe:2.3:a:siemens:scalance_x-300_firmware:3.5.1:*:*:*:*:*:*:*
cpe:2.3:h:siemens:scalance_x-300:-:*:*:*:*:*:*:*
History

No history.

Information

Published : 2012-04-18 10:33

Updated : 2024-02-04 18:16

NVD link : CVE-2012-1802

Mitre link : CVE-2012-1802

CVE.ORG link : CVE-2012-1802

JSON object : View

Products Affected

siemens

  • scalance_xr-300_firmware
  • scalance_x-300
  • scalance_x414-3e_firmware
  • scalance_x-300_firmware
  • scalance_x-300eec
  • scalance_xr-300
  • scalance_x-300eec_firmware
  • scalance_x308-2m
  • scalance_x414-3e
  • scalance_x308-2m_firmware
CWE
CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer