CVE-2022-348208.4HighCWE-77

CVE-2022-34820: Siemens SIMATIC CP 1242-7 V2 vulnerability

Siemens · SIMATIC CP 1242-7 V2

Affected: Siemens SIMATIC CP 1242-7 V2 · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

2.3%probability of exploitation in the next 30 days

83rd percentile

050100

Higher than 83% of scored CVEs

8.4HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All versions < V3.3.46), SIMATIC CP 1542SP-1 IRC (All versions >= V2.0 < V2.2.28), SIMATIC CP 1543-1 (All versions < V3.0.22), SIMATIC CP 1543SP-1 (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1542SP-1 IRC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC (All versions >= V2.0 < V2.2.28), SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAIL (All versions >= V2.0 < V2.2.28), SIPLUS NET CP 1242-7 V2 (All versions < V3.3.46), SIPLUS NET CP 1543-1 (All versions < V3.0.22), SIPLUS S7-1200 CP 1243-1 (All versions < V3.3.46), SIPLUS S7-1200 CP 1243-1 RAIL (All versions < V3.3.46). The application does not correctly escape some user provided fields during the authentication process. This could allow an attacker to inject custom commands and execute arbitrary code with elevated privileges.

Affected products15

From the CVE record. A product or version that is not listed is unknown, not unaffected.

Siemens · SIMATIC CP 1242-7 V2All versions < V3.3.46
Siemens · SIMATIC CP 1243-1All versions < V3.3.46
Siemens · SIMATIC CP 1243-7 LTE EUAll versions < V3.3.46
Siemens · SIMATIC CP 1243-7 LTE USAll versions < V3.3.46
Siemens · SIMATIC CP 1243-8 IRCAll versions < V3.3.46
Siemens · SIMATIC CP 1542SP-1 IRCAll versions >= V2.0 < V2.2.28
Siemens · SIMATIC CP 1543-1All versions < V3.0.22
Siemens · SIMATIC CP 1543SP-1All versions >= V2.0 < V2.2.28
Siemens · SIPLUS ET 200SP CP 1542SP-1 IRC TX RAILAll versions >= V2.0 < V2.2.28
Siemens · SIPLUS ET 200SP CP 1543SP-1 ISECAll versions >= V2.0 < V2.2.28
Siemens · SIPLUS ET 200SP CP 1543SP-1 ISEC TX RAILAll versions >= V2.0 < V2.2.28
Siemens · SIPLUS NET CP 1242-7 V2All versions < V3.3.46
Siemens · SIPLUS NET CP 1543-1All versions < V3.0.22
Siemens · SIPLUS S7-1200 CP 1243-1All versions < V3.3.46
Siemens · SIPLUS S7-1200 CP 1243-1 RAILAll versions < V3.3.46

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Command Injection · Command and Code Injection
Vendor: Siemens
Published: July 2022
Band: Possible (1 to 10%), July 2022

CoverageNo articles yet

No CyberSIXT article names CVE-2022-34820 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.