CVE-2022-38773

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot image of the device and execute arbitrary code.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1326

Affected software

VendorProductVersions
SiemensSIMATIC Drive Controller CPU 1504D TF< *
SiemensSIMATIC Drive Controller CPU 1507D TF< *
SiemensSIMATIC S7-1500 CPU 1510SP F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1510SP F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1510SP-1 PN< *
SiemensSIMATIC S7-1500 CPU 1510SP-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511C-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511C-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511T-1 PN< *
SiemensSIMATIC S7-1500 CPU 1511TF-1 PN< *
SiemensSIMATIC S7-1500 CPU 1512C-1 PN< *
SiemensSIMATIC S7-1500 CPU 1512C-1 PN< *
SiemensSIMATIC S7-1500 CPU 1512SP F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1512SP F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1512SP-1 PN< *
SiemensSIMATIC S7-1500 CPU 1512SP-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513F-1 PN< *
SiemensSIMATIC S7-1500 CPU 1513R-1 PN< *
SiemensSIMATIC S7-1500 CPU 1515-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515F-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515F-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515F-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515R-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515T-2 PN< *
SiemensSIMATIC S7-1500 CPU 1515TF-2 PN< *
SiemensSIMATIC S7-1500 CPU 1516-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516F-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516F-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516F-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516T-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1516TF-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1517-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1517F-3 PN/DP< *
SiemensSIMATIC S7-1500 CPU 1517H-3 PN< *
SiemensSIMATIC S7-1500 CPU 1517T-3 PN/DP< *

References

Timeline

Published
Jan 10, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-387747.8An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivilegCVE-2022-387757.8An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate thCVE-2022-387777.8An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate thCVE-2022-387786.5A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a requCVE-2022-387796.1An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciouslyCVE-2022-38789.8A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browsCVE-2022-387847.8Poppler prior to and including 22.08.0 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIGStream.cc)CVE-2022-387867.8Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentiaCVE-2022-387877.8Improper input validation in firmware for some Intel(R) FPGA products before version 2.7.0 Hotfix may allow an authenticated user to potentiCVE-2022-387884.3An issue was discovered in Nokia FastMile 5G Receiver 5G14-B 1.2104.00.0281. Bluetooth on the Nokia ODU uses outdated pairing mechanisms, alCVE-2022-387899.1An issue was discovered in Airties Smart Wi-Fi before 2020-08-04. It allows attackers to change the main/guest SSID and the PSK to arbitraryCVE-2022-38796.5The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in a
CVE-2022-38773: Medium severity, CVSS 6.8 | Vulnix