Skip to content
Fencer Vulns
critical 10.0

CVE-2024-22039 json

A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All ver…

published 2024-03-12 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-19642

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.8%
EPSS 0.8% chance of exploitation in 30 days, percentile 57%
public exploits
0
none known

Summary

A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions < IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All versions < IP6 SR3), Cerberus PRO EN Fire Panel FC72x IP7 (All versions < IP7 SR5), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions < V3.0.6602), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.0.5016), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions < V3.2.6601), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.2.5015), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions < MP8), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions < MP6 SR3), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions < MP7 SR5), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions < V3.0.6602), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.0.5016), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions < V3.2.6601), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.2.5015), Sinteso Mobile (All versions < V3.0.0). The network communication library in affected systems does not validate the length of certain X.509 certificate attributes which might result in a stack-based buffer overflow. This could allow an unauthenticated remote attacker to execute code on the underlying operating system with root privileges.

Patch / fix

  • Siemens Cerberus PRO EN Engineering Tool IP8
  • Siemens Cerberus PRO EN Fire Panel FC72x IP6 IP6 SR3
  • Siemens Cerberus PRO EN Fire Panel FC72x IP7 IP7 SR5
  • Siemens Cerberus PRO EN X200 Cloud Distribution IP7 V3.0.6602
  • Siemens Cerberus PRO EN X200 Cloud Distribution IP8 V4.0.5016
  • Siemens Cerberus PRO EN X300 Cloud Distribution IP7 V3.2.6601
  • Siemens Cerberus PRO EN X300 Cloud Distribution IP8 V4.2.5015
  • Siemens Cerberus PRO UL Compact Panel FC922/924 MP4
  • Siemens Cerberus PRO UL Engineering Tool MP4
  • Siemens Cerberus PRO UL X300 Cloud Distribution V4.3.0001
  • Siemens Desigo Fire Safety UL Compact Panel FC2025/2050 MP4
  • Siemens Desigo Fire Safety UL Engineering Tool MP4
  • Siemens Desigo Fire Safety UL X300 Cloud Distribution V4.3.0001
  • Siemens Sinteso FS20 EN Engineering Tool MP8
  • Siemens Sinteso FS20 EN Fire Panel FC20 MP6 MP6 SR3
  • Siemens Sinteso FS20 EN Fire Panel FC20 MP7 MP7 SR5
  • Siemens Sinteso FS20 EN X200 Cloud Distribution MP7 V3.0.6602
  • Siemens Sinteso FS20 EN X200 Cloud Distribution MP8 V4.0.5016
  • Siemens Sinteso FS20 EN X300 Cloud Distribution MP7 V3.2.6601
  • Siemens Sinteso FS20 EN X300 Cloud Distribution MP8 V4.2.5015
  • Siemens Sinteso Mobile V3.0.0
  • siemens desigo_fire_safety_ul_compact_panel mp4
  • siemens desigo_fire_safety_ul_engineering_tool v4.3.0001

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-24-074-09 updated cvss 10.0

Siemens Sinteso EN Cerberus PRO EN Fire Protection Systems

  • Siemens Cerberus PRO EN Engineering Tool <IP8 Siemens Cerberus PRO EN Fire Panel FC72x IP6 <IP6_SR3 Siemens Cerberus PRO EN Fire Panel FC72x IP7 <IP7_SR5
    affected: vendor fix
  • Siemens Cerberus PRO EN X200 Cloud Distribution IP7 <V3.0.6602
    affected: fixed in V3.0.6602
  • Siemens Cerberus PRO EN X200 Cloud Distribution IP8 <V4.0.5016
    affected: fixed in V4.0.5016
  • Siemens Cerberus PRO EN X300 Cloud Distribution IP7 <V3.2.6601
    affected: fixed in V3.2.6601
  • Siemens Cerberus PRO EN X300 Cloud Distribution IP8 <V4.2.5015
    affected: fixed in V4.2.5015
  • Siemens Sinteso FS20 EN Engineering Tool <MP8 Siemens Sinteso FS20 EN Fire Panel FC20 MP6 <MP6_SR3 Siemens Sinteso FS20 EN Fire Panel FC20 MP7 <MP7_SR5
    affected: vendor fix
  • Siemens Sinteso FS20 EN X200 Cloud Distribution MP7 <V3.0.6602
    affected: fixed in V3.0.6602
  • Siemens Sinteso FS20 EN X200 Cloud Distribution MP8 <V4.0.5016
    affected: fixed in V4.0.5016
show 3 more
  • Siemens Sinteso FS20 EN X300 Cloud Distribution MP7 <V3.2.6601
    affected: fixed in V3.2.6601
  • Siemens Sinteso FS20 EN X300 Cloud Distribution MP8 <V4.2.5015
    affected: fixed in V4.2.5015
  • Siemens Sinteso Mobile <V3.0.0
    affected: fixed in V3.0.0

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-24-137-12 updated cvss 10.0

Siemens Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems

  • Siemens Cerberus PRO UL Compact Panel FC922/924 <MP4 Siemens Cerberus PRO UL Engineering Tool <MP4
    affected: vendor fix
  • Siemens Cerberus PRO UL X300 Cloud Distribution <V4.3.0001
    affected: fixed in V4.3.0001
  • Siemens Desigo Fire Safety UL Compact Panel FC2025/2050 <MP4 Siemens Desigo Fire Safety UL Engineering Tool <MP4
    affected: vendor fix
  • Siemens Desigo Fire Safety UL X300 Cloud Distribution <V4.3.0001
    affected: fixed in V4.3.0001

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.81% chance of exploitation in the next 30 days, higher than 57% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Siemens Cerberus PRO EN Engineering Tool
  • Siemens Cerberus PRO EN Fire Panel FC72x IP6
  • Siemens Cerberus PRO EN Fire Panel FC72x IP7
  • Siemens Cerberus PRO EN X200 Cloud Distribution IP7
  • Siemens Cerberus PRO EN X200 Cloud Distribution IP8
  • Siemens Cerberus PRO EN X300 Cloud Distribution IP7
  • Siemens Cerberus PRO EN X300 Cloud Distribution IP8
  • Siemens Cerberus PRO UL Compact Panel FC922/924
  • Siemens Cerberus PRO UL Engineering Tool
  • Siemens Cerberus PRO UL X300 Cloud Distribution
  • Siemens Desigo Fire Safety UL Compact Panel FC2025/2050
  • Siemens Desigo Fire Safety UL Engineering Tool
  • Siemens Desigo Fire Safety UL X300 Cloud Distribution
  • Siemens Sinteso FS20 EN Engineering Tool
  • Siemens Sinteso FS20 EN Fire Panel FC20 MP6
  • Siemens Sinteso FS20 EN Fire Panel FC20 MP7
  • Siemens Sinteso FS20 EN X200 Cloud Distribution MP7
  • Siemens Sinteso FS20 EN X200 Cloud Distribution MP8
  • Siemens Sinteso FS20 EN X300 Cloud Distribution MP7
  • Siemens Sinteso FS20 EN X300 Cloud Distribution MP8
  • Siemens Sinteso Mobile
  • siemens cerberus_pro_en_engineering_tool
  • siemens cerberus_pro_en_fire_panel_fc72x
  • siemens cerberus_pro_en_x300_cloud_distribution
  • siemens cerberus_pro_ul_compact_panel
  • siemens cerberus_pro_en_x200_cloud_distribution
  • siemens cerberus_pro_ul_engineering_tool
  • siemens cerberus_pro_ul_x300_cloud
  • siemens desigo_fire_safety_ul_compact_panel
  • siemens desigo_fire_safety_ul_engineering_tool
  • siemens sinteso_fs20_en_fire_panel_fc20
  • siemens sinteso_fs20_en_x200_cloud_distribution
  • siemens sinteso_fs20_en_x300_cloud_distribution
  • siemens sinteso_mobile

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.