VulnerabilityModified

CVE-2022-46143

This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data.

MEDIUM 5.1EPSS 0.70%

Does this matter?

Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.

Description

Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data.

CVSS 4.0: 5.1 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.70% probability · 51th percentile
CISA KEV: Not listed
Weakness: CWE-1284
Affected: siemens/ruggedcom rm1224 lte\(4g\) eu firmware · siemens/ruggedcom rm1224 lte\(4g\) nam firmware · siemens/scalance m804pb firmware · siemens/scalance m812-1 adsl-router firmware · siemens/scalance m816-1 adsl-router firmware · siemens/scalance m826-2 shdsl-router firmware · siemens/scalance m874-2 firmware · siemens/scalance m874-3 firmware · siemens/scalance m876-3 firmware · siemens/scalance m876-4 firmware · siemens/scalance mum853-1 firmware · siemens/scalance mum856-1 firmware · siemens/scalance s615 firmware · siemens/scalance s615 eec firmware · siemens/scalance sc622-2c firmware · siemens/scalance sc626-2c firmware · siemens/scalance sc632-2c firmware · siemens/scalance sc636-2c firmware · siemens/scalance sc642-2c firmware · siemens/scalance sc646-2c firmware · +40 more
Source: productcert@siemens.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.