CVE-2022-36323

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

VendorProductVersions
SiemensRUGGEDCOM RM1224 LTE(4G) EU< V7.1.2
SiemensRUGGEDCOM RM1224 LTE(4G) NAM< V7.1.2
SiemensSCALANCE M804PB< V7.1.2
SiemensSCALANCE M812-1 ADSL-Router< V7.1.2
SiemensSCALANCE M812-1 ADSL-Router< V7.1.2
SiemensSCALANCE M816-1 ADSL-Router< V7.1.2
SiemensSCALANCE M816-1 ADSL-Router< V7.1.2
SiemensSCALANCE M826-2 SHDSL-Router< V7.1.2
SiemensSCALANCE M874-2< V7.1.2
SiemensSCALANCE M874-3< V7.1.2
SiemensSCALANCE M876-3< V7.1.2
SiemensSCALANCE M876-3 (ROK)< V7.1.2
SiemensSCALANCE M876-4 (EU)< V7.1.2
SiemensSCALANCE M876-4 (NAM)< V7.1.2
SiemensSCALANCE MUM853-1 (EU)< V7.1.2
SiemensSCALANCE MUM856-1 (EU)< V7.1.2
SiemensSCALANCE MUM856-1 (RoW)< V7.1.2
SiemensSCALANCE S615 LAN-Router< V7.1.2
SiemensSCALANCE SC622-2C< V2.3.1
SiemensSCALANCE SC626-2C< V2.3.1
SiemensSCALANCE SC632-2C< V2.3.1
SiemensSCALANCE SC636-2C< V2.3.1
SiemensSCALANCE SC642-2C< V2.3.1
SiemensSCALANCE SC646-2C< V2.3.1
SiemensSCALANCE W1748-1 M12< *
SiemensSCALANCE W1748-1 M12< *
SiemensSCALANCE W1788-1 M12< *
SiemensSCALANCE W1788-2 EEC M12< *
SiemensSCALANCE W1788-2 M12< *
SiemensSCALANCE W1788-2IA M12< *
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W721-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W722-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45< V6.6.0
SiemensSCALANCE W734-1 RJ45 (USA)< V6.6.0
SiemensSCALANCE W734-1 RJ45 (USA)< V6.6.0
SiemensSCALANCE W738-1 M12< V6.6.0
SiemensSCALANCE W738-1 M12< V6.6.0

References

Timeline

Published
Aug 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-363247.5Affected devices do not properly handle the renegotiation of SSL/TLS parameters. This could allow an unauthenticated remote attacker to bypaCVE-2022-363254.8Affected devices do not properly sanitize data introduced by an user when rendering the web interface. This could allow an authenticated remCVE-2022-363264.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amountCVE-2022-363279.8Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to write files to CVE-2022-363284.9Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could allow an attacker to create arbitrarCVE-2022-363297.5An improper privilege management issue that could allow an attacker to cause a denial of service over the OTA mechanism was discovered in WeCVE-2022-36333.3A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function j1939_session_destroy of the file net/canCVE-2022-363308.1A buffer overflow vulnerability was discovered on firmware version validation that could lead to an unauthenticated remote code execution inCVE-2022-363317.5Western Digital My Cloud, My Cloud Home, My Cloud Home Duo, and SanDisk ibi devices were vulnerable to an impersonation attack that could alCVE-2022-363367.8A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local CVE-2022-363378.2An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration drivCVE-2022-363388.2An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, c
CVE-2022-36323: Critical severity, CVSS 9.1 | Vulnix