CVE-2022-29875Not scoredCWE-502

CVE-2022-29875: Siemens Biograph Horizon PET/CT Systems vulnerability

Siemens · Biograph Horizon PET/CT Systems

Affected: Siemens Biograph Horizon PET/CT Systems · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

1.9%probability of exploitation in the next 30 days

79th percentile

050100

Higher than 79% of scored CVEs

Not scored yet. The CVE record carries no CVSS score.

DescriptionCVE.org

A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A), MAMMOMAT Revelation (All VC20 versions < VC20D), NAEOTOM Alpha (All VA40 versions < VA40 SP2), SOMATOM X.cite (All versions < VA30 SP5 or VA40 SP2), SOMATOM X.creed (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.All (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Now (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Open Pro (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Sim (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Top (All versions < VA30 SP5 or VA40 SP2), SOMATOM go.Up (All versions < VA30 SP5 or VA40 SP2), Symbia E/S (All VB22 versions < VB22A-UD03), Symbia Evo (All VB22 versions < VB22A-UD03), Symbia Intevo (All VB22 versions < VB22A-UD03), Symbia T (All VB22 versions < VB22A-UD03), Symbia.net (All VB22 versions < VB22A-UD03), syngo.via VB10 (All versions), syngo.via VB20 (All versions), syngo.via VB30 (All versions), syngo.via VB40 (All versions < VB40B HF06), syngo.via VB50 (All versions), syngo.via VB60 (All versions < VB60B HF02). The application deserialises untrusted data without sufficient validations that could result in an arbitrary deserialization. This could allow an unauthenticated attacker to execute code in the affected system if ports 32912/tcp or 32914/tcp are reachable.

Affected products20

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Siemens · Biograph Horizon PET/CT SystemsAll VJ30 versions < VJ30C-UD01
Siemens · MAGNETOM FamilyNUMARIS X: VA12M, VA12S, VA10B, VA20A, VA30A, VA31A
Siemens · MAMMOMAT RevelationAll VC20 versions < VC20D
Siemens · NAEOTOM AlphaAll VA40 versions < VA40 SP2
Siemens · SOMATOM X.citeAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM X.creedAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM go.AllAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM go.NowAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM go.Open ProAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM go.SimAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM go.TopAll versions < VA30 SP5 or VA40 SP2
Siemens · SOMATOM go.UpAll versions < VA30 SP5 or VA40 SP2
Siemens · Symbia E/SAll VB22 versions < VB22A-UD03
Siemens · Symbia EvoAll VB22 versions < VB22A-UD03
Siemens · Symbia IntevoAll VB22 versions < VB22A-UD03
Siemens · Symbia TAll VB22 versions < VB22A-UD03
Siemens · Symbia.netAll VB22 versions < VB22A-UD03
Siemens · syngo.via VB10All versions
Siemens · syngo.via VB20All versions
Siemens · syngo.via VB30All versions

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Deserialization of Untrusted Data · Deserialization and Object Injection
Vendor: Siemens
Published: June 2022
Band: Possible (1 to 10%), June 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2022-29875 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.