CVE-2024-22039: Siemens Cerberus Pro En Engineering Tool

Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days.

A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO EN Fire Panel FC72x IP7 (All versions < IP7 SR5), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions < V3.0.6602), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.0.5016), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions < V3.2.6601), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.2.5015), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions < MP8), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions < MP6 SR3), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions < MP7 SR5), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions < V3.0.6602), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.2.5015), Sinteso Mobile (All versions < V3.0.0). The network communication library in affected systems does not validate the length of certain X.509 certificate attributes which might result in a stack-based buffer overflow. This could allow an unauthenticated remote attacker to execute code on the underlying operating system with root privileges.

Affected products

• Siemens Cerberus Pro En Engineering Tool: before ip8 (fixed in ip8)
• Siemens Cerberus Pro En Fire Panel FC72X: before ip8 (fixed in ip8)
• Siemens Cerberus Pro En x200 Cloud Distribution: before 4.0.5016 (fixed in 4.0.5016)
• Siemens Cerberus Pro En x300 Cloud Distribution: before 4.2.5015 (fixed in 4.2.5015)
• Siemens Sinteso FS20 En Engineering Tool: before mp8 (fixed in mp8)
• Siemens Sinteso FS20 En Fire Panel FC20: before mp8 (fixed in mp8)
• Siemens Sinteso FS20 En x200 Cloud Distribution: before 4.0.5016 (fixed in 4.0.5016)
• Siemens Sinteso FS20 En x300 Cloud Distribution: before 4.2.5015 (fixed in 4.2.5015)
• Siemens Sinteso Mobile: before 3.0.0 (fixed in 3.0.0)

Published 2024-03-12. Last modified 2026-06-17.