Skip to content
Fencer Vulns
high 7.5

CVE-2022-38767 json

An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denia…

published 2022-11-25 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-41330

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 66%
public exploits
0
none known

Summary

An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial of Service during the IP Radius access procedure.

Patch / fix

  • Siemens SIPROTEC 5 6MD85 (CP300) V9.30
  • Siemens SIPROTEC 5 6MD86 (CP300) V9.30
  • Siemens SIPROTEC 5 6MD89 (CP300) V9.64
  • Siemens SIPROTEC 5 6MU85 (CP300) V9.30
  • Siemens SIPROTEC 5 7KE85 (CP300) V9.30
  • Siemens SIPROTEC 5 7SA86 (CP300) V9.30
  • Siemens SIPROTEC 5 7SA87 (CP300) V9.30
  • Siemens SIPROTEC 5 7SD86 (CP300) V9.30
  • Siemens SIPROTEC 5 7SD87 (CP300) V9.30
  • Siemens SIPROTEC 5 7SJ85 (CP300) V9.30
  • Siemens SIPROTEC 5 7SJ86 (CP300) V9.30
  • Siemens SIPROTEC 5 7SK85 (CP300) V9.30
  • Siemens SIPROTEC 5 7SL86 (CP300) V9.30
  • Siemens SIPROTEC 5 7SL87 (CP300) V9.30
  • Siemens SIPROTEC 5 7SS85 (CP300) V9.30
  • Siemens SIPROTEC 5 7ST85 (CP300) V9.30
  • Siemens SIPROTEC 5 7ST86 (CP300) V9.30
  • Siemens SIPROTEC 5 7SX85 (CP300) V9.30
  • Siemens SIPROTEC 5 7UM85 (CP300) V9.30
  • Siemens SIPROTEC 5 7UT85 (CP300) V9.30
  • Siemens SIPROTEC 5 7UT86 (CP300) V9.30
  • Siemens SIPROTEC 5 7UT87 (CP300) V9.30
  • Siemens SIPROTEC 5 7VE85 (CP300) V9.30
  • Siemens SIPROTEC 5 7VK87 (CP300) V9.30
  • Siemens SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1) V9.30
  • Siemens SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1) V9.30
  • Siemens SIPROTEC 5 Communication Module ETH-BD-2FO V9.30
  • Siemens SIPROTEC 5 Compact 7SX800 (CP050) V9.30

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-23-080-04 updated cvss 7.5

Siemens RADIUS Client of SIPROTEC 5 Devices

  • Siemens SIPROTEC 5 6MD85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 6MD86 (CP300) >= 7.80, < 9.30
    affected: fixed in V9.30, mitigation support.industry.siemens.com
  • Siemens SIPROTEC 5 6MD89 (CP300) >= 7.80, < 9.64
    affected: fixed in V9.64, mitigation support.industry.siemens.com
  • Siemens SIPROTEC 5 6MU85 (CP300) >= 7.90, < 9.30 Siemens SIPROTEC 5 7KE85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SA86 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SA87 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SD86 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SD87 (CP300) >= 7.80, < 9.30
    +15 more products
    Siemens SIPROTEC 5 7SJ85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SJ86 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SK85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SL86 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SL87 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7SS85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7ST85 (CP300) >= 8.81, < 9.30 Siemens SIPROTEC 5 7ST86 (CP300) >= 9.20, < 9.30 Siemens SIPROTEC 5 7SX85 (CP300) >= 8.30, < 9.30 Siemens SIPROTEC 5 7UM85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7UT85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7UT86 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7UT87 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7VE85 (CP300) >= 7.80, < 9.30 Siemens SIPROTEC 5 7VK87 (CP300) >= 7.80, < 9.30
    affected: fixed in V9.30, mitigation support.industry.siemens.com
  • Siemens SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1) >= 7.80, < 9.30 Siemens SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1) >= 7.80, < 9.30 Siemens SIPROTEC 5 Communication Module ETH-BD-2FO >= 7.80, < 9.30
    affected: fixed in V9.30, mitigation support.industry.siemens.com
  • Siemens SIPROTEC 5 Compact 7SX800 (CP050) >= 8.70, < 9.30
    affected: fixed in V9.30, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
18 mo ago

Exploit prediction

1.11% chance of exploitation in the next 30 days, higher than 66% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Siemens SIPROTEC 5 6MD85 (CP300)
  • Siemens SIPROTEC 5 6MD86 (CP300)
  • Siemens SIPROTEC 5 6MD89 (CP300)
  • Siemens SIPROTEC 5 6MU85 (CP300)
  • Siemens SIPROTEC 5 7KE85 (CP300)
  • Siemens SIPROTEC 5 7SA86 (CP300)
  • Siemens SIPROTEC 5 7SA87 (CP300)
  • Siemens SIPROTEC 5 7SD86 (CP300)
  • Siemens SIPROTEC 5 7SD87 (CP300)
  • Siemens SIPROTEC 5 7SJ85 (CP300)
  • Siemens SIPROTEC 5 7SJ86 (CP300)
  • Siemens SIPROTEC 5 7SK85 (CP300)
  • Siemens SIPROTEC 5 7SL86 (CP300)
  • Siemens SIPROTEC 5 7SL87 (CP300)
  • Siemens SIPROTEC 5 7SS85 (CP300)
  • Siemens SIPROTEC 5 7ST85 (CP300)
  • Siemens SIPROTEC 5 7ST86 (CP300)
  • Siemens SIPROTEC 5 7SX85 (CP300)
  • Siemens SIPROTEC 5 7UM85 (CP300)
  • Siemens SIPROTEC 5 7UT85 (CP300)
  • Siemens SIPROTEC 5 7UT86 (CP300)
  • Siemens SIPROTEC 5 7UT87 (CP300)
  • Siemens SIPROTEC 5 7VE85 (CP300)
  • Siemens SIPROTEC 5 7VK87 (CP300)
  • Siemens SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.1)
  • Siemens SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 1)
  • Siemens SIPROTEC 5 Communication Module ETH-BD-2FO
  • Siemens SIPROTEC 5 Compact 7SX800 (CP050)

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.