{"answers":{"affected":"It affects 3 products.","exploited":"There is no known exploitation of CVE-2022-29884 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2022-29884 yet. Limit exposure of the affected software until one is available.","what":"CVE-2022-29884 is a high-severity denial of service vulnerability in Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C, published on 12 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2022-29884 and fix it if it is affected.\n\nWhat it is: CVE-2022-29884 is a high-severity denial of service vulnerability in Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C, published on 12 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2022-29884 in the wild and no public exploit code.\n\nAffected product: Siemens CP-8000 MASTER MODULE WITH I/O -25/+70°C. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2022-29884/ (Markdown: https://insights.sbomify.com/CVE-2022-29884/index.md)","id":"CVE-2022-29884","markdown":"https://insights.sbomify.com/CVE-2022-29884/index.md","name":"CVE-2022-29884","record":{"aliases":["GHSA-fc38-5jq6-2248"],"analysis":{"component_type":"ics_ot","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Siemens CP-8000 module","requires_auth":"none","summary":"Unauthenticated remote attackers can cause denial of service on Siemens CP-8000 modules by exploiting resource management flaws in the HTTPS server.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"siemens","cpe":[{"product":"sicam_a8000_cp-8000_firmware","vendor":"siemens"},{"product":"sicam_a8000_cp-8021_firmware","vendor":"siemens"},{"product":"sicam_a8000_cp-8022_firmware","vendor":"siemens"}],"cvss":{"score":7.5,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-772","name":"Missing Release of Resource after Effective Lifetime"}],"description":"A vulnerability has been identified in CP-8000 MASTER MODULE WITH I/O -25/+70°C (All versions \u003c CPC80 V16.30), CP-8000 MASTER MODULE WITH I/O -40/+70°C (All versions \u003c CPC80 V16.30), CP-8021 MASTER MODULE (All versions \u003c CPC80 V16.30), CP-8022 MASTER MODULE WITH GPRS (All versions \u003c CPC80 V16.30). When using the HTTPS server under specific conditions, affected devices do not properly free resources. This could allow an unauthenticated remote attacker to put the device into a denial of service condition.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":null,"headline":"Denial of service in CP-8000 MASTER MODULE WITH I/O -25/+70°C","id":"CVE-2022-29884","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"denial_of_service","year":"2022"},"n_packages":0,"n_references":1,"next":{"headline":"EncryptInterceptor does not provide complete protection on insecure networks","id":"CVE-2022-29885"},"packages":[],"prev":{"headline":"Missing authorization in SICAM T","id":"CVE-2022-29883"},"products":["CP-8000 MASTER MODULE WITH I/O -25/+70°C","CP-8000 MASTER MODULE WITH I/O -40/+70°C","CP-8021 MASTER MODULE","CP-8022 MASTER MODULE WITH GPRS"],"published":"2022-07-12","related":[{"cvss_score":7.5,"headline":"Denial of service in SICAM A8000 CP-8000, SICAM A8000 CP-802X, SICAM A8000 CP-8050","id":"CVE-2018-13798","kev_date_added":null,"published":"2019-03-21"},{"cvss_score":7.3,"headline":"Weak cryptography in SICAM A8000 CP-8000","id":"CVE-2020-28396","kev_date_added":null,"published":"2020-12-14"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["Siemens"]},"summary":"Unauthenticated remote attackers can cause denial of service on Siemens CP-8000 modules by exploiting resource management flaws in the HTTPS server.","url":"https://insights.sbomify.com/CVE-2022-29884/"}