CVE-2022-2335 : A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integra

A crafted HTTP packet with a -1 content-length header can create a denial-of-service condition in Softing Secure Integration Server V1.22.

Published 2022-08-17 21:15:09

Updated 2022-08-19 01:49:05

Source ICS-CERT

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2022-2335

Softing » OPC » Version: 5.2
cpe:2.3:a:softing:opc:5.2:*:*:*:*:*:*:*
Matching versions
Softing » Edgeconnector » Version: 3.1
cpe:2.3:a:softing:edgeconnector:3.1:*:*:*:*:*:*:*
Matching versions
Softing » Secure Integration Server » Version: 1.22
cpe:2.3:a:softing:secure_integration_server:1.22:*:*:*:*:*:*:*
Matching versions
Softing » Uagates » Version: 1.74
cpe:2.3:a:softing:uagates:1.74:*:*:*:*:*:*:*
Matching versions
Softing » Opc Ua C++ Software Development Kit » Version: 6
cpe:2.3:a:softing:opc_ua_c\+\+_software_development_kit:6:*:*:*:*:*:*:*
Matching versions
Softing » Edgeaggregator » Version: 3.1
cpe:2.3:a:softing:edgeaggregator:3.1:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.36%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 72 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	ICS-CERT
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE-191 Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Assigned by: ics-cert@hq.dhs.gov (Primary)

Jump to