ghsa-p4gg-xc3g-rqm7
Vulnerability from github
A vulnerability has been identified in SCALANCE XM408-4C (All versions < V6.5), SCALANCE XM408-4C (L3 int.) (All versions < V6.5), SCALANCE XM408-8C (All versions < V6.5), SCALANCE XM408-8C (L3 int.) (All versions < V6.5), SCALANCE XM416-4C (All versions < V6.5), SCALANCE XM416-4C (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 1x230V (All versions < V6.5), SCALANCE XR524-8C, 1x230V (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 24V (All versions < V6.5), SCALANCE XR524-8C, 24V (L3 int.) (All versions < V6.5), SCALANCE XR524-8C, 2x230V (All versions < V6.5), SCALANCE XR524-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 1x230V (All versions < V6.5), SCALANCE XR526-8C, 1x230V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 24V (All versions < V6.5), SCALANCE XR526-8C, 24V (L3 int.) (All versions < V6.5), SCALANCE XR526-8C, 2x230V (All versions < V6.5), SCALANCE XR526-8C, 2x230V (L3 int.) (All versions < V6.5), SCALANCE XR528-6M (All versions < V6.5), SCALANCE XR528-6M (2HR2) (All versions < V6.5), SCALANCE XR528-6M (2HR2, L3 int.) (All versions < V6.5), SCALANCE XR528-6M (L3 int.) (All versions < V6.5), SCALANCE XR552-12M (All versions < V6.5), SCALANCE XR552-12M (2HR2) (All versions < V6.5), SCALANCE XR552-12M (2HR2) (All versions < V6.5), SCALANCE XR552-12M (2HR2, L3 int.) (All versions < V6.5). The OSPF protocol implementation in affected devices fails to verify the checksum and length fields in the OSPF LS Update messages. An unauthenticated remote attacker could exploit this vulnerability to cause interruptions in the network by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device.
{
"affected": [],
"aliases": [
"CVE-2021-37182"
],
"database_specific": {
"cwe_ids": [
"CWE-354"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-14T10:15:00Z",
"severity": "HIGH"
},
"details": "A vulnerability has been identified in SCALANCE XM408-4C (All versions \u003c V6.5), SCALANCE XM408-4C (L3 int.) (All versions \u003c V6.5), SCALANCE XM408-8C (All versions \u003c V6.5), SCALANCE XM408-8C (L3 int.) (All versions \u003c V6.5), SCALANCE XM416-4C (All versions \u003c V6.5), SCALANCE XM416-4C (L3 int.) (All versions \u003c V6.5), SCALANCE XR524-8C, 1x230V (All versions \u003c V6.5), SCALANCE XR524-8C, 1x230V (L3 int.) (All versions \u003c V6.5), SCALANCE XR524-8C, 24V (All versions \u003c V6.5), SCALANCE XR524-8C, 24V (L3 int.) (All versions \u003c V6.5), SCALANCE XR524-8C, 2x230V (All versions \u003c V6.5), SCALANCE XR524-8C, 2x230V (L3 int.) (All versions \u003c V6.5), SCALANCE XR526-8C, 1x230V (All versions \u003c V6.5), SCALANCE XR526-8C, 1x230V (L3 int.) (All versions \u003c V6.5), SCALANCE XR526-8C, 24V (All versions \u003c V6.5), SCALANCE XR526-8C, 24V (L3 int.) (All versions \u003c V6.5), SCALANCE XR526-8C, 2x230V (All versions \u003c V6.5), SCALANCE XR526-8C, 2x230V (L3 int.) (All versions \u003c V6.5), SCALANCE XR528-6M (All versions \u003c V6.5), SCALANCE XR528-6M (2HR2) (All versions \u003c V6.5), SCALANCE XR528-6M (2HR2, L3 int.) (All versions \u003c V6.5), SCALANCE XR528-6M (L3 int.) (All versions \u003c V6.5), SCALANCE XR552-12M (All versions \u003c V6.5), SCALANCE XR552-12M (2HR2) (All versions \u003c V6.5), SCALANCE XR552-12M (2HR2) (All versions \u003c V6.5), SCALANCE XR552-12M (2HR2, L3 int.) (All versions \u003c V6.5). The OSPF protocol implementation in affected devices fails to verify the checksum and length fields in the OSPF LS Update messages. An unauthenticated remote attacker could exploit this vulnerability to cause interruptions in the network by sending specially crafted OSPF packets. Successful exploitation requires OSPF to be enabled on an affected device.",
"id": "GHSA-p4gg-xc3g-rqm7",
"modified": "2022-06-28T00:00:50Z",
"published": "2022-06-15T00:00:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37182"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-145224.pdf"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.