CVE-2022-45937 — HIGH (8.8)

Q: How severe is CVE-2022-45937?

CVE-2022-45937 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2022-45937?

Check the references section above for vendor advisories and patch information. Affected products include: Siemens Pxc00-E96.A Firmware, Siemens Pxc00-E96.A, Siemens Pxc100-E96.A Firmware, Siemens Pxc100-E96.A, Siemens Pxx-485.3 Firmware.

Vulnerability Description

A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5.5), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.20), TALON TC Compact (BACnet) (All versions < V3.5.5), TALON TC Modular (BACnet) (All versions < V3.5.5). A low privilege authenticated attacker with network access to the integrated web server could download sensitive information from the device containing user account credentials.

CVSS Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Siemens	Pxc00-E96.A Firmware	< 3.5.5
Siemens	Pxc00-E96.A	-
Siemens	Pxc100-E96.A Firmware	< 3.5.5
Siemens	Pxc100-E96.A	-
Siemens	Pxx-485.3 Firmware	< 3.5.5
Siemens	Pxx-485.3	-
Siemens	Pxc16.2-Pe.A Firmware	< 2.8.20
Siemens	Pxc16.2-Pe.A	-
Siemens	Pxc24.2-Pe.A Firmware	< 2.8.20
Siemens	Pxc24.2-Pe.A	-
Siemens	Pxc24.2-Pef.A Firmware	< 2.8.20
Siemens	Pxc24.2-Pef.A	-
Siemens	Pxc24.2-Per.A Firmware	< 2.8.20
Siemens	Pxc24.2-Per.A	-
Siemens	Pxc24.2-Perf.A Firmware	< 2.8.20
Siemens	Pxc24.2-Perf.A	-
Siemens	Talon Tc Modular \(Bacnet\) Firmware	< 3.5.5
Siemens	Talon Tc Modular \(Bacnet\)	-

Related Weaknesses (CWE)

CWE-284

References

https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdfPatchVendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-180579.pdfPatchVendor Advisory

FAQ

What is CVE-2022-45937?

CVE-2022-45937 is a vulnerability with a CVSS score of 8.8 (HIGH). A vulnerability has been identified in APOGEE PXC Compact (BACnet) (All versions < V3.5.5), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.20), APOGEE PXC Modular (BACnet) (All versions < V3.5....

How severe is CVE-2022-45937?

CVE-2022-45937 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-45937?

Check the references section above for vendor advisories and patch information. Affected products include: Siemens Pxc00-E96.A Firmware, Siemens Pxc00-E96.A, Siemens Pxc100-E96.A Firmware, Siemens Pxc100-E96.A, Siemens Pxx-485.3 Firmware.