Medium severity · published Jan 10, 2023
CVE-2022-38773
Affected devices do not contain an Immutable Root of Trust in Hardware
6.8
CVSS
0.3%
EPSS
No
On KEV
Description
Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot image of the device and execute arbitrary code.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Simatic Drive Controller Cpu 1504d TF Firmware · Siemens
All versions, or not specified · source: NVD
SD
Simatic Drive Controller Cpu 1507d TF Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1510sp F-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1510sp-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1511-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1511c-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1511f-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1511t-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1511tf-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1512c-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1512sp F-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
SS
Simatic S7-1500 Cpu 1512sp-1 PN Firmware · Siemens
All versions, or not specified · source: NVD
Affected product
SD
Simatic Drive Controller Cpu 1504d TF Firmware
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-38773
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-38773
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-482757.html
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-482757.pdf
More from Simatic Drive Controller Cpu 1504d TF Firmware
7.8
CVE-2022-38465
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl
7.5
CVE-2023-46156
Affected devices improperly handle specially crafted packets sent to port 102/tcp
7.5
CVE-2023-28831
The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infinite loop during…
7.5
CVE-2021-37205
A vulnerability has been identified in SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl
7.5
CVE-2021-37204
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC Drive Controller family (All versions >= V2.9.2 < V2.9.4), SIMATIC ET 200SP…