APOGEE MBC (PPC) (BACnet): Missing Release of Memory after Effective Lifetime
CVE-2022-38371 is a high-severity missing release of memory after effective lifetime vulnerability in APOGEE MBC (PPC) (BACnet) from Siemens, with a CVSS 3.1 base score of 7.5 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. Affected APOGEE MBC (PPC) (BACnet) versions: All versions. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 1.6% chance of exploitation within 30 days, higher than 76% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update APOGEE PXC Compact (BACnet) to V3.5.7 or a later version.
- Update APOGEE PXC Compact (P2 Ethernet) to V2.8.21 or a later version.
- Update APOGEE PXC Modular (BACnet) to V3.5.7 or a later version.
- Read the advisory on cert-portal.siemens.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Siemens | APOGEE MBC (PPC) (BACnet) | All versions | Not stated |
| Siemens | APOGEE MBC (PPC) (P2 Ethernet) | All versions | Not stated |
| Siemens | APOGEE MEC (PPC) (BACnet) | All versions | Not stated |
| Siemens | APOGEE MEC (PPC) (P2 Ethernet) | All versions | Not stated |
| Siemens | APOGEE PXC Compact (BACnet) | before V3.5.7 | V3.5.7 |
| Siemens | APOGEE PXC Compact (P2 Ethernet) | before V2.8.21 | V2.8.21 |
| Siemens | APOGEE PXC Modular (BACnet) | before V3.5.7 | V3.5.7 |
| Siemens | APOGEE PXC Modular (P2 Ethernet) | before V2.8.21 | V2.8.21 |
| Siemens | Desigo PXC00-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC00-U | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC001-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC100-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC12-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC128-U | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC200-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC22-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC22.1-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC36.1-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC50-E.D | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXC64-U | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Desigo PXM20-E | V2.3 up to, but not including, V6.30.37 | V6.30.37 |
| Siemens | Nucleus NET for Nucleus PLUS V1 | All versions < V5.2a | Not stated |
| Siemens | Nucleus NET for Nucleus PLUS V2 | All versions < V5.4 | Not stated |
| Siemens | Nucleus ReadyStart V3 V2012 | All versions < V2012.08.1 | Not stated |
| Siemens | Nucleus ReadyStart V3 V2017 | All versions < V2017.02.4 | Not stated |
Version data comes from the organisation that assigned the CVE; 23 further products are omitted here. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- NoneNo data is disclosed.
- Integrity
- NoneNothing can be modified.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Scored by NVD.
| Scoring system | Score | Severity | Scored by |
|---|---|---|---|
| CVSS 4.0 | 8.7 | High | CNA (siemens.com) |
| CVSS 3.1 | 7.5 | High | CNA (siemens.com) |
| CVSS 3.1 | 7.5 | High | NVD |
Official description
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions < V3.5.7), APOGEE PXC Compact (P2 Ethernet) (All versions < V2.8.21), APOGEE PXC Modular (BACnet) (All versions < V3.5.7), APOGEE PXC Modular (P2 Ethernet) (All versions < V2.8.21), Desigo PXC00-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC00-U (All versions >= V2.3 < V6.30.37), Desigo PXC001-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC100-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC12-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC128-U (All versions >= V2.3 < V6.30.37), Desigo PXC200-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC22-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC22.1-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC36.1-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC50-E.D (All versions >= V2.3 < V6.30.37), Desigo PXC64-U (All versions >= V2.3 < V6.30.37), Desigo PXM20-E (All versions >= V2.3 < V6.30.37), Nucleus NET for Nucleus PLUS V1 (All versions < V5.2a), Nucleus NET for Nucleus PLUS V2 (All versions < V5.4), Nucleus ReadyStart V3 V2012 (All versions < V2012.08.1), Nucleus ReadyStart V3 V2017 (All versions < V2017.02.4), Nucleus Source Code (All versions including affected FTP server), TALON TC Compact (BACnet) (All versions < V3.5.7), TALON TC Modular (BACnet) (All versions < V3.5.7). The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Missing Release of Memory after Effective Lifetime
The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
How developers prevent this class of flaw
- Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC). To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std
- Use an abstraction library to abstract away risky APIs. Not a complete solution.
- Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.
More Missing Release of Memory after Effective Lifetime vulnerabilities (CWE-401)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: partial).
- Record last changed materially (score, affected products, status or references).
References
Advisories
Other references
Other vulnerabilities in APOGEE MBC (PPC) (BACnet)
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 8.2 High severity
Recent Missing Release of Memory after Effective Lifetime vulnerabilities
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.5 High severity
- 7.8 High severity
Spotted an error? Tell us.