CVE-2022-34819

Name: CVE-2022-34819
Creator: NVD / NIST
Published: 2022-07-12T10:15:12.293+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 10/10EPSS 1.52%

Last modified Jun 17, 2026

CVE-2022-34819 is a critical-severity vulnerability rated 10/10 on the CVSS scale. A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application lacks proper validation of user-supplied data when parsing specific messages. EPSS estimates a 1.52% chance of exploitation in the next 30 days.

Description

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application lacks proper validation of user-supplied data when parsing specific messages. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of device.

Metrics

CVSS 3.1

10/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Probability

1.52%

71.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Siemens	Simatic Cp 1242-7 V2 Firmware	All versions
Siemens	Simatic Cp 1243-1 Firmware	All versions
Siemens	Simatic Cp 1243-7 Lte Eu Firmware	All versions
Siemens	Simatic Cp 1243-7 Lte Us Firmware	All versions
Siemens	Simatic Cp 1243-8 Irc Firmware	All versions
Siemens	Simatic Cp 1542sp-1 Irc Firmware	>= 2.0
Siemens	Simatic Cp 1543-1 Firmware	< 3.0.22
Siemens	Simatic Cp 1543sp-1 Firmware	>= 2.0
Siemens	Siplus Et 200sp Cp 1542sp-1 Irc Tx Rail Firmware	>= 2.0
Siemens	Siplus Et 200sp Cp 1543sp-1 Isec Firmware	>= 2.0
Siemens	Siplus Et 200sp Cp 1543sp-1 Isec Tx Rail Firmware	>= 2.0
Siemens	Siplus Net Cp 1242-7 V2 Firmware	All versions
Siemens	Siplus Net Cp 1543-1 Firmware	< 3.0.22
Siemens	Siplus S7-1200 Cp 1243-1 Firmware	All versions
Siemens	Siplus S7-1200 Cp 1243-1 Rail Firmware	All versions

References

https://cert-portal.siemens.com/productcert/pdf/ssa-517377.pdfPatch, Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-517377.pdfPatch, Vendor Advisory

Timeline

Published: Jul 12, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-34819?

How severe is CVE-2022-34819?

CVE-2022-34819 has a CVSS score of 10/10 (CRITICAL severity). The EPSS model estimates a 1.52% probability of exploitation in the next 30 days.

How do I fix CVE-2022-34819?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-34819?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST