CVE-2022-31810

A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size of data packets received for the configuration client login, causing a stack-based buffer overflow. This could allow an unauthenticated remote attacker to crash the server application, creating a denial of service condition.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/pdf/ssa-924149.pdf	Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-924149.pdf	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:sipass_integrated:*:*:*:*:*:*:*:*

History

23 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en SiPass integrated (Todas las versiones anteriores a V2.90.3.8). Las aplicaciones de servidor afectadas comprueban incorrectamente el tamaño de los paquetes de datos recibidos para el inicio de sesión del cliente de configuración, causando un desbordamiento de búfer basado en pila. Esto podría permitir a un atacante remoto no autenticado bloquear la aplicación de servidor, creando una condición de denegación de servicio.

Information

Published : 2023-07-11 10:15

Updated : 2026-10-23 23:10

NVD link : CVE-2022-31810

Mitre link : CVE-2022-31810

CVE.ORG link : CVE-2022-31810

JSON object : View

Products Affected

siemens

sipass_integrated

CWE

CWE-20

Improper Input Validation

CWE-787

Out-of-bounds Write

{"id": "CVE-2022-31810", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-31810", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-05T18:38:55.893124Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "productcert@siemens.com", "affectedData": [{"vendor": "Siemens", "product": "SiPass integrated", "versions": [{"status": "affected", "version": "All versions < V2.90.3.8"}], "defaultStatus": "unknown"}]}], "published": "2023-07-11T10:15:10.127", "references": [{"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-924149.pdf", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-924149.pdf", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size of data packets received for the configuration client login, causing a stack-based buffer overflow.\r\n\r\nThis could allow an unauthenticated remote attacker to crash the server application, creating a denial of service condition."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en SiPass integrated (Todas las versiones anteriores a V2.90.3.8). Las aplicaciones de servidor afectadas comprueban incorrectamente el tama\u00f1o de los paquetes de datos recibidos para el inicio de sesi\u00f3n del cliente de configuraci\u00f3n, causando un desbordamiento de b\u00fafer basado en pila.\n\nEsto podr\u00eda permitir a un atacante remoto no autenticado bloquear la aplicaci\u00f3n de servidor, creando una condici\u00f3n de denegaci\u00f3n de servicio."}], "lastModified": "2026-10-23T23:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sipass_integrated:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC7AA710-4928-4B8B-AF56-24E4F5548AEA", "versionEndExcluding": "2.90.3.8"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}