description: A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x (All versions < IP8 SR4), Cerberus PRO EN X200 Cloud Distribution (All versions < V4.3.5618), Cerberus PRO EN X300 Cloud Distribution (All versions < V4.3.5617), Sinteso FS20 EN Engineering Tool (All versions), Sinteso FS20 EN Fire Panel FC20 (All versions < MP8 SR4), Sinteso FS20 EN X200 Cloud Distribution (All versions < V4.3.5618), Sinteso FS20 EN X300 Cloud Distribution (All versions < V4.3.5617), Sinteso Mobile (All versions). The network communication library in affected systems insufficiently validates HMAC values which might result in a buffer overread.
This could allow an unauthenticated remote attacker to crash the network service.
problem types: CWE-125: Out-of-bounds Read
affected:
{
vendor: Siemens
product: Cerberus PRO EN Engineering Tool
versions:
status: affected, version: 0, lessThan: *, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Cerberus PRO EN Fire Panel FC72x
versions:
status: affected, version: 0, lessThan: IP8 SR4, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Cerberus PRO EN X200 Cloud Distribution
versions:
status: affected, version: 0, lessThan: V4.3.5618, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Cerberus PRO EN X300 Cloud Distribution
versions:
status: affected, version: 0, lessThan: V4.3.5617, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Sinteso FS20 EN Engineering Tool
versions:
status: affected, version: 0, lessThan: *, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Sinteso FS20 EN Fire Panel FC20
versions:
status: affected, version: 0, lessThan: MP8 SR4, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Sinteso FS20 EN X200 Cloud Distribution
versions:
status: affected, version: 0, lessThan: V4.3.5618, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Sinteso FS20 EN X300 Cloud Distribution
versions:
status: affected, version: 0, lessThan: V4.3.5617, versionType: custom
defaultStatus: unknown
}
{
vendor: Siemens
product: Sinteso Mobile
versions:
status: affected, version: 0, lessThan: *, versionType: custom
defaultStatus: unknown
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
baseScore: 7.5
baseSeverity: HIGH
]