Strix
26.1K

CVE-2022-36324

HIGHCVSS 7.5/10EPSS 1.44%

Last modified

CVE-2022-36324 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.. EPSS estimates a 1.44% chance of exploitation in the next 30 days.

Description

Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.

Metrics

CVSS 3.1
7.5/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Probability
1.44%

69.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
SiemensScalance M-800 FirmwareAll versions
SiemensScalance S615 FirmwareAll versions
SiemensScalance W700 Ieee 802.11ax FirmwareAll versions
SiemensScalance W700 Ieee 802.11n FirmwareAll versions
SiemensScalance W700 Ieee 802.11ac FirmwareAll versions
SiemensScalance Xb-200 FirmwareAll versions
SiemensScalance Xb205-3 FirmwareAll versions
SiemensScalance Xb205-3ld FirmwareAll versions
SiemensScalance Xb208 FirmwareAll versions
SiemensScalance Xb213-3 FirmwareAll versions
SiemensScalance Xb213-3ld FirmwareAll versions
SiemensScalance Xb216 FirmwareAll versions
SiemensScalance Xc-200 FirmwareAll versions
SiemensScalance Xc206-2 FirmwareAll versions
SiemensScalance Xc206-2g Poe FirmwareAll versions
SiemensScalance Xc206-2g Poe Eec FirmwareAll versions
SiemensScalance Xc206-2sfp Eec FirmwareAll versions
SiemensScalance Xc206-2sfp G FirmwareAll versions
SiemensScalance Xc206-2sfp G \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc206-2sfp G Eec FirmwareAll versions
SiemensScalance Xc208 FirmwareAll versions
SiemensScalance Xc208eec FirmwareAll versions
SiemensScalance Xc208g FirmwareAll versions
SiemensScalance Xc208g \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc208g Eec FirmwareAll versions
SiemensScalance Xc208g Poe FirmwareAll versions
SiemensScalance Xc216 FirmwareAll versions
SiemensScalance Xc216-4c FirmwareAll versions
SiemensScalance Xc216-4c G FirmwareAll versions
SiemensScalance Xc216-4c G \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc216-4c G Eec FirmwareAll versions
SiemensScalance Xc216eec FirmwareAll versions
SiemensScalance Xc224 FirmwareAll versions
SiemensScalance Xc224-4c G FirmwareAll versions
SiemensScalance Xc224-4c G \(E\/Ip\) FirmwareAll versions
SiemensScalance Xc224-4c G Eec FirmwareAll versions
SiemensScalance Xf-200ba FirmwareAll versions
SiemensScalance Xf204-2ba Dna FirmwareAll versions
SiemensScalance Xf204-2ba Irt FirmwareAll versions
SiemensScalance Xm400 FirmwareAll versions
SiemensScalance Xm408-4c FirmwareAll versions
SiemensScalance Xm408-4c L3 FirmwareAll versions
SiemensScalance Xm408-8c FirmwareAll versions
SiemensScalance Xm408-8c L3 FirmwareAll versions
SiemensScalance Xm416-4c FirmwareAll versions
SiemensScalance Xm416-4c L3 FirmwareAll versions
SiemensScalance Xp-200 FirmwareAll versions
SiemensScalance Xp208 FirmwareAll versions
SiemensScalance Xp208 \(Eip\) FirmwareAll versions
SiemensScalance Xp208eec FirmwareAll versions

Showing 50 of 84 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-36324?
Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypass the TCP brute force prevention and lead to a denial of service condition for the duration of the attack.
How severe is CVE-2022-36324?
CVE-2022-36324 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 1.44% probability of exploitation in the next 30 days.
How do I fix CVE-2022-36324?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-36324?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST