CVE-2022-25622
Last modified
CVE-2022-25622 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.. EPSS estimates a 0.82% chance of exploitation in the next 30 days.
Description
The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Simatic Cfu Diq Firmware | All versions |
| Siemens | Simatic Cfu Pa Firmware | All versions |
| Siemens | Simatic S7-300 Cpu Firmware | All versions |
| Siemens | Simatic S7-400h V6 Firmware | All versions |
| Siemens | Simatic S7-400 Pn\/Dp V7 Firmware | All versions |
| Siemens | Simatic S7-410 V8 Firmware | All versions |
| Siemens | Simatic S7-410 V10 Firmware | All versions |
| Siemens | Simatic S7-1500 Cpu Firmware | < 2.0.0 |
| Siemens | Simatic Tdc Cp51m1 Firmware | All versions |
| Siemens | Simatic Tdc Cpu555 Firmware | All versions |
| Siemens | Simatic Winac Rtx Firmware | All versions |
| Siemens | Simit Simulation Platform | All versions |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2022-25622?
How severe is CVE-2022-25622?
How do I fix CVE-2022-25622?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2022
- CVE-2022-25615Cross-Site Request Forgery (CSRF) in StylemixThemes eRoom – …4.3
- CVE-2022-25617Reflected Cross-Site Scripting (XSS) vulnerability in Code S…6.1
- CVE-2022-25618Authenticated (admin+) Stored Cross-Site Scripting (XSS) vul…4.8
- CVE-2022-25619Improper Neutralization of Special Elements used in a Comman…6.7
- CVE-2022-25620Improper Neutralization of Script-Related HTML Tags in a Web…9
- CVE-2022-25621UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8…9.8
- CVE-2022-25623The Symantec Management Agent is susceptible to a privilege …7.8
- CVE-2022-25625A malicious unauthorized PAM user can access the administrat…8.8
- CVE-2022-25626An unauthenticated user can access Identity Manager’s manage…5.3
- CVE-2022-25627An authenticated administrator who has physical access to th…6.7
- CVE-2022-25628An authenticated user can perform XML eXternal Entity inject…8.8
- CVE-2022-25629An authenticated user who has the privilege to add/edit anno…5.4
Are you affected by CVE-2022-25622?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST