Siemens Scalance w778-1 m12 Eec Firmware vulnerabilities

3 CVEs affecting Siemens Scalance w778-1 m12 Eec Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-46143, published 2022-12-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-46143, published 2022-12-13. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. Affected devices do not check the TFTP blocksize correctly. This could allow an authenticated attacker to read from an uninitialized buffer that potentially contains previously allocated data.
CVE-2022-46142, published 2022-12-13. Medium severity, CVSS 5.7. EPSS: 0.3% chance of exploitation in the next 30 days. Affected devices store the CLI user passwords encrypted in flash memory. Attackers with physical access to the device could retrieve the file and decrypt the CLI user passwords.
CVE-2022-46140, published 2022-12-13. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. Affected devices use a weak encryption scheme to encrypt the debug zip file. This could allow an authenticated attacker to decrypt the contents of the file and retrieve debug information about the…