VulnerabilityModified
CVE-2022-46140
Affected devices use a weak encryption scheme to encrypt the debug zip file.
HIGH 7.1EPSS 0.23%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.23%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the system.
- CVSS 4.0
- 7.1 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.23% probability · 14th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-327
- Affected
- siemens/ruggedcom rm1224 lte\(4g\) eu firmware · siemens/ruggedcom rm1224 lte\(4g\) nam firmware · siemens/scalance m804pb firmware · siemens/scalance m812-1 adsl-router firmware · siemens/scalance m816-1 adsl-router firmware · siemens/scalance m826-2 shdsl-router firmware · siemens/scalance m874-2 firmware · siemens/scalance m874-3 firmware · siemens/scalance m876-3 firmware · siemens/scalance m876-4 firmware · siemens/scalance mum853-1 firmware · siemens/scalance mum856-1 firmware · siemens/scalance s615 firmware · siemens/scalance s615 eec firmware · siemens/scalance sc622-2c firmware · siemens/scalance sc626-2c firmware · siemens/scalance sc632-2c firmware · siemens/scalance sc636-2c firmware · siemens/scalance sc642-2c firmware · siemens/scalance sc646-2c firmware · +40 more
- Source
- productcert@siemens.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.