A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges.
References
| Link | Resource |
|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf | Mitigation Vendor Advisory |
| https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf | Mitigation Vendor Advisory |
Configurations
History
21 Nov 2024, 06:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf - Mitigation, Vendor Advisory |
10 Oct 2023, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges. |
Information
Published : 2022-03-08 12:15
Updated : 2024-11-21 06:50
NVD link : CVE-2022-24282
Mitre link : CVE-2022-24282
CVE.ORG link : CVE-2022-24282
JSON object : View
Products Affected
siemens
- sinec_network_management_system
CWE
CWE-502
Deserialization of Untrusted Data