Vulnerability-Lookup

CNVD-2023-13094

Vulnerability from cnvd - Published: 2023-03-01

Title

Siemens SiPass integrated AC5102/ACC-G2和ACC-A命令注入漏洞

Description

ACC-AP (Advanced Central Controller) 是一种门控制器，最多可用于两个连接到互联网/内联网的门，用于与SiPass集成访问控制系统通信。AC5102 / ACC-G2 (Advanced Central Controller) 是SiPass集成访问控制系统的中央控制器。 Siemens SiPass integrated AC5102/ACC-G2和ACC-A存在命令注入漏洞，该漏洞是由于受影响的设备未能正确地过滤telnet命令行界面上的用户输入。允许经过身份验证的攻击者利用该漏洞通过注入以root权限执行的任意命令来升级权限。

Severity

高

Patch Name

Siemens SiPass integrated AC5102/ACC-G2和ACC-A命令注入漏洞的补丁

Patch Description

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf

Reference

https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf

Impacted products

Name
['SIEMENS Siemens SiPass integrated ACC-AP <V2.85.43', 'Siemens SiPass integrated AC5102 (ACC-G2) < V2.85.4']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2022-31808",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2022-31808"
    }
  },
  "description": "ACC-AP (Advanced Central Controller) \u662f\u4e00\u79cd\u95e8\u63a7\u5236\u5668\uff0c\u6700\u591a\u53ef\u7528\u4e8e\u4e24\u4e2a\u8fde\u63a5\u5230\u4e92\u8054\u7f51/\u5185\u8054\u7f51\u7684\u95e8\uff0c\u7528\u4e8e\u4e0eSiPass\u96c6\u6210\u8bbf\u95ee\u63a7\u5236\u7cfb\u7edf\u901a\u4fe1\u3002AC5102 / ACC-G2 (Advanced Central Controller) \u662fSiPass\u96c6\u6210\u8bbf\u95ee\u63a7\u5236\u7cfb\u7edf\u7684\u4e2d\u592e\u63a7\u5236\u5668\u3002\n\nSiemens SiPass integrated AC5102/ACC-G2\u548cACC-A\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7684\u8bbe\u5907\u672a\u80fd\u6b63\u786e\u5730\u8fc7\u6ee4telnet\u547d\u4ee4\u884c\u754c\u9762\u4e0a\u7684\u7528\u6237\u8f93\u5165\u3002\u5141\u8bb8\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6ce8\u5165\u4ee5root\u6743\u9650\u6267\u884c\u7684\u4efb\u610f\u547d\u4ee4\u6765\u5347\u7ea7\u6743\u9650\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2023-13094",
  "openTime": "2023-03-01",
  "patchDescription": "ACC-AP (Advanced Central Controller) \u662f\u4e00\u79cd\u95e8\u63a7\u5236\u5668\uff0c\u6700\u591a\u53ef\u7528\u4e8e\u4e24\u4e2a\u8fde\u63a5\u5230\u4e92\u8054\u7f51/\u5185\u8054\u7f51\u7684\u95e8\uff0c\u7528\u4e8e\u4e0eSiPass\u96c6\u6210\u8bbf\u95ee\u63a7\u5236\u7cfb\u7edf\u901a\u4fe1\u3002AC5102 / ACC-G2 (Advanced Central Controller) \u662fSiPass\u96c6\u6210\u8bbf\u95ee\u63a7\u5236\u7cfb\u7edf\u7684\u4e2d\u592e\u63a7\u5236\u5668\u3002\r\n\r\nSiemens SiPass integrated AC5102/ACC-G2\u548cACC-A\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u662f\u7531\u4e8e\u53d7\u5f71\u54cd\u7684\u8bbe\u5907\u672a\u80fd\u6b63\u786e\u5730\u8fc7\u6ee4telnet\u547d\u4ee4\u884c\u754c\u9762\u4e0a\u7684\u7528\u6237\u8f93\u5165\u3002\u5141\u8bb8\u7ecf\u8fc7\u8eab\u4efd\u9a8c\u8bc1\u7684\u653b\u51fb\u8005\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u6ce8\u5165\u4ee5root\u6743\u9650\u6267\u884c\u7684\u4efb\u610f\u547d\u4ee4\u6765\u5347\u7ea7\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SiPass integrated AC5102/ACC-G2\u548cACC-A\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SIEMENS Siemens SiPass integrated ACC-AP \u003cV2.85.43",
      "Siemens SiPass integrated AC5102 (ACC-G2) \u003c V2.85.4"
    ]
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2023-02-17",
  "title": "Siemens SiPass integrated AC5102/ACC-G2\u548cACC-A\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2022-31808 (GCVE-0-2022-31808)

Vulnerability from cvelistv5 – Published: 2023-02-14 10:36 – Updated: 2025-03-20 20:14

Summary

A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly sanitize user input on the telnet command line interface. This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-03-20 20:14 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

siemens icscert root

References

1 reference

URL	Tags
https://cert-portal.siemens.com/productcert/pdf/s…

Impacted products

2 products

Vendor	Product	Version
Siemens	SiPass integrated AC5102 (ACC-G2)	Affected: All versions < V2.85.44
Siemens	SiPass integrated ACC-AP	Affected: All versions < V2.85.43

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T07:26:01.373Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-31808",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-03-20T20:14:00.542637Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-03-20T20:14:08.699Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "SiPass integrated AC5102 (ACC-G2)",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V2.85.44"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "SiPass integrated ACC-AP",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "All versions \u003c V2.85.43"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions \u003c V2.85.44), SiPass integrated ACC-AP (All versions \u003c V2.85.43). Affected devices improperly sanitize user input on the telnet command line interface.\r\n\r\nThis could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-02-15T09:24:44.436Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-658793.pdf"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2022-31808",
    "datePublished": "2023-02-14T10:36:07.859Z",
    "dateReserved": "2022-05-30T10:21:52.587Z",
    "dateUpdated": "2025-03-20T20:14:08.699Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.