CVE:CVE-2022-40176
CNNVD:CNNVD-202210-509
Siemens Desigo PX是德国西门子（Siemens）公司的一套楼宇自动化控制系统。
Siemens 多款产品存在操作系统命令注入漏洞，该漏洞源于由于缺少对输入包中包含的文件名的验证，在还原操作期间存在对具有 root 权限的 OS 命令中使用的特殊元素的不正确中和。通过恢复特制的软件包，远程低权限攻击者可以在设备上以 root 权限执行任意系统命令，从而导致全面入侵。Desigo PXM30-1 V02.20.126.11-41 版本之前，Desigo PXM30.E V02.20.126.11-41 版本之前，Desigo PXM40-1 V02.20.126.11-41 版本之前，Desigo PXM40.E V02.20.126.11-41 版本之前，Desigo PXM50-1 V02.20.126.11-41 版本之前，Desigo PXM50.E V02.20.126.11-41 版本之前，PXG3.W100-1 V02.20.126.11-37 版本之前，PXG3.W100-2 V02.20.126.11-41 版本之前，PXG3.W200-1 V02.20.126.11-37 版本之前，PXG3.W200-2 V02.20.126.11-41 版本之前。
solution:Upgrade siemens desigo_pxm30-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm30.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm40.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50-1_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens desigo_pxm50.e_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w100-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w100-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41); Upgrade siemens pxg3.w200-1_firmware to a higher version than 02.20.126.11-37,and avoid the version (,02.20.126.11-37); Upgrade siemens pxg3.w200-2_firmware to a higher version than 02.20.126.11-41,and avoid the version (,02.20.126.11-41)