Read the docs
TI-2024-14659 Aliases CVE-2024-22040GHSA-q75q-wf9j-xqjf

Out-of-bounds read in Siemens Cerberus PRO EN Engineering Tool

Priority MEDIUM 42CWE-125Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-125 and the CVSS impact.

Summary

A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), Cerberus PRO EN Fire Panel FC72x IP7 (All versions), Cerberus PRO EN Fire Panel FC72x IP8 (All versions < IP8 SR4), Cerberus PRO EN X200 Cloud Distribution IP7 (All versions), Cerberus PRO EN X200 Cloud Distribution IP8 (All versions < V4.3.5618), Cerberus PRO EN X300 Cloud Distribution IP7 (All versions), Cerberus PRO EN X300 Cloud Distribution IP8 (All versions < V4.3.5617), Cerberus PRO UL Compact Panel FC922/924 (All versions < MP4), Cerberus PRO UL Engineering Tool (All versions < MP4), Cerberus PRO UL X300 Cloud Distribution (All versions < V4.3.0001), Desigo Fire Safety UL Compact Panel FC2025/2050 (All versions < MP4), Desigo Fire Safety UL Engineering Tool (All versions < MP4), Desigo Fire Safety UL X300 Cloud Distribution (All versions < V4.3.0001), Sinteso FS20 EN Engineering Tool (All versions), Sinteso FS20 EN Fire Panel FC20 MP6 (All versions), Sinteso FS20 EN Fire Panel FC20 MP7 (All versions), Sinteso FS20 EN Fire Panel FC20 MP8 (All versions < MP8 SR4), Sinteso FS20 EN X200 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X200 Cloud Distribution MP8 (All versions < V4.3.5618), Sinteso FS20 EN X300 Cloud Distribution MP7 (All versions), Sinteso FS20 EN X300 Cloud Distribution MP8 (All versions < V4.3.5617), Sinteso Mobile (All versions). The network communication library in affected systems insufficiently validates HMAC values which might result in a buffer overread. This could allow an unauthenticated remote attacker to crash the network service.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00832 57th percentileScored 2026-11-07
Fix Fixed Cerberus PRO EN Fire Panel FC72x IP8 (Siemens): IP8 SR4Cerberus PRO EN X200 Cloud Distribution IP8 (Siemens): V4.3.5618+10 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SiemensCerberus PRO EN Engineering Toolall versions—No fix listedCNA
SiemensCerberus PRO EN Fire Panel FC72x IP6all versions—No fix listedCNA
SiemensCerberus PRO EN Fire Panel FC72x IP7all versions—No fix listedCNA
SiemensCerberus PRO EN Fire Panel FC72x IP8before IP8 SR4IP8 SR4Patch availableCNA
SiemensCerberus PRO EN X200 Cloud Distribution IP7all versions—No fix listedCNA
SiemensCerberus PRO EN X200 Cloud Distribution IP8before V4.3.5618V4.3.5618Patch availableCNA
SiemensCerberus PRO EN X300 Cloud Distribution IP7all versions—No fix listedCNA
SiemensCerberus PRO EN X300 Cloud Distribution IP8before V4.3.5617V4.3.5617Patch availableCNA
SiemensCerberus PRO UL Compact Panel FC922/924before MP4MP4Patch availableCNA
SiemensCerberus PRO UL Engineering Toolbefore MP4MP4Patch availableCNA
SiemensCerberus PRO UL X300 Cloud Distributionbefore V4.3.0001V4.3.0001Patch availableCNA
SiemensDesigo Fire Safety UL Compact Panel FC2025/2050before MP4MP4Patch availableCNA
SiemensDesigo Fire Safety UL Engineering Toolbefore MP4MP4Patch availableCNA
SiemensDesigo Fire Safety UL X300 Cloud Distributionbefore V4.3.0001V4.3.0001Patch availableCNA
SiemensSinteso FS20 EN Engineering Toolall versions—No fix listedCNA
SiemensSinteso FS20 EN Fire Panel FC20 MP6all versions—No fix listedCNA
SiemensSinteso FS20 EN Fire Panel FC20 MP7all versions—No fix listedCNA
SiemensSinteso FS20 EN Fire Panel FC20 MP8before MP8 SR4MP8 SR4Patch availableCNA
SiemensSinteso FS20 EN X200 Cloud Distribution MP7all versions—No fix listedCNA
SiemensSinteso FS20 EN X200 Cloud Distribution MP8before V4.3.5618V4.3.5618Patch availableCNA
SiemensSinteso FS20 EN X300 Cloud Distribution MP7all versions—No fix listedCNA
SiemensSinteso FS20 EN X300 Cloud Distribution MP8before V4.3.5617V4.3.5617Patch availableCNA
SiemensSinteso Mobileall versions—No fix listedCNA
  • Cerberus PRO EN Engineering Tool VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Cerberus PRO EN Fire Panel FC72x IP6 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Cerberus PRO EN Fire Panel FC72x IP7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Cerberus PRO EN Fire Panel FC72x IP8 VendorSiemens Affected before IP8 SR4 Fixed in IP8 SR4 Patch available CNA
  • Cerberus PRO EN X200 Cloud Distribution IP7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Cerberus PRO EN X200 Cloud Distribution IP8 VendorSiemens Affected before V4.3.5618 Fixed in V4.3.5618 Patch available CNA
  • Cerberus PRO EN X300 Cloud Distribution IP7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Cerberus PRO EN X300 Cloud Distribution IP8 VendorSiemens Affected before V4.3.5617 Fixed in V4.3.5617 Patch available CNA
  • Cerberus PRO UL Compact Panel FC922/924 VendorSiemens Affected before MP4 Fixed in MP4 Patch available CNA
  • Cerberus PRO UL Engineering Tool VendorSiemens Affected before MP4 Fixed in MP4 Patch available CNA
  • Cerberus PRO UL X300 Cloud Distribution VendorSiemens Affected before V4.3.0001 Fixed in V4.3.0001 Patch available CNA
  • Desigo Fire Safety UL Compact Panel FC2025/2050 VendorSiemens Affected before MP4 Fixed in MP4 Patch available CNA
  • Desigo Fire Safety UL Engineering Tool VendorSiemens Affected before MP4 Fixed in MP4 Patch available CNA
  • Desigo Fire Safety UL X300 Cloud Distribution VendorSiemens Affected before V4.3.0001 Fixed in V4.3.0001 Patch available CNA
  • Sinteso FS20 EN Engineering Tool VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Sinteso FS20 EN Fire Panel FC20 MP6 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Sinteso FS20 EN Fire Panel FC20 MP7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Sinteso FS20 EN Fire Panel FC20 MP8 VendorSiemens Affected before MP8 SR4 Fixed in MP8 SR4 Patch available CNA
  • Sinteso FS20 EN X200 Cloud Distribution MP7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Sinteso FS20 EN X200 Cloud Distribution MP8 VendorSiemens Affected before V4.3.5618 Fixed in V4.3.5618 Patch available CNA
  • Sinteso FS20 EN X300 Cloud Distribution MP7 VendorSiemens Affected all versions Fixed in — No fix listed CNA
  • Sinteso FS20 EN X300 Cloud Distribution MP8 VendorSiemens Affected before V4.3.5617 Fixed in V4.3.5617 Patch available CNA
  • Sinteso Mobile VendorSiemens Affected all versions Fixed in — No fix listed CNA

CPE names CISA-ADP · 14

CPEVersionsRoleVendor
cpe:2.3:a:siemens:cerberus_pro_en_engineering_tool:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:cerberus_pro_en_fire_panel_fc72x:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:cerberus_pro_en_x300_cloud_distribution:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:cerberus_pro_ul_compact_panel:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:cerberus_pro_en_x200_cloud_distribution:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
cpe:2.3:a:siemens:cerberus_pro_ul_engineering_tool:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:cerberus_pro_ul_x300_cloud:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:desigo_fire_safety_ul_compact_panel:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:desigo_fire_safety_ul_engineering_tool:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:sinteso_fs20_en_fire_panel_fc20:-:*:*:*:*:*:*:*not specified by CISA-ADP—Siemens
  • cpe:2.3:a:siemens:cerberus_pro_en_engineering_tool:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:cerberus_pro_en_fire_panel_fc72x:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:cerberus_pro_en_x300_cloud_distribution:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:cerberus_pro_ul_compact_panel:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:cerberus_pro_en_x200_cloud_distribution:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
  • cpe:2.3:a:siemens:cerberus_pro_ul_engineering_tool:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:cerberus_pro_ul_x300_cloud:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:desigo_fire_safety_ul_compact_panel:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:desigo_fire_safety_ul_engineering_tool:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:sinteso_fs20_en_fire_panel_fc20:-:*:*:*:*:*:*:* Versions not specified by CISA-ADP — ·Siemens
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:siemens:sinteso_fs20_en_x200_cloud_distribution:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:sinteso_fs20_en_x300_cloud_distribution:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:sinteso_mobile:*:*:*:*:*:*:*:*——Siemens
cpe:2.3:a:siemens:sinteso_fs20_en_engineering_tool:*:*:*:*:*:*:*:*——Siemens
  • cpe:2.3:a:siemens:sinteso_fs20_en_x200_cloud_distribution:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:sinteso_fs20_en_x300_cloud_distribution:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:sinteso_mobile:*:*:*:*:*:*:*:* Versions — — ·Siemens
  • cpe:2.3:a:siemens:sinteso_fs20_en_engineering_tool:*:*:*:*:*:*:*:* Versions — — ·Siemens

Remediation

  • Fix · CNA Cerberus PRO EN Fire Panel FC72x IP8 (Siemens) Fixed in IP8 SR4
  • Fix · CNA Cerberus PRO EN X200 Cloud Distribution IP8 (Siemens) Fixed in V4.3.5618
  • Fix · CNA Cerberus PRO EN X300 Cloud Distribution IP8 (Siemens) Fixed in V4.3.5617
  • Fix · CNA Cerberus PRO UL Compact Panel FC922/924 (Siemens) Fixed in MP4
  • Fix · CNA Cerberus PRO UL Engineering Tool (Siemens) Fixed in MP4
  • Fix · CNA Cerberus PRO UL X300 Cloud Distribution (Siemens) Fixed in V4.3.0001
  • Fix · CNA Desigo Fire Safety UL Compact Panel FC2025/2050 (Siemens) Fixed in MP4
  • Fix · CNA Desigo Fire Safety UL Engineering Tool (Siemens) Fixed in MP4
  • Fix · CNA Desigo Fire Safety UL X300 Cloud Distribution (Siemens) Fixed in V4.3.0001
  • Fix · CNA Sinteso FS20 EN Fire Panel FC20 MP8 (Siemens) Fixed in MP8 SR4
  • Fix · CNA Sinteso FS20 EN X200 Cloud Distribution MP8 (Siemens) Fixed in V4.3.5618
  • Fix · CNA Sinteso FS20 EN X300 Cloud Distribution MP8 (Siemens) Fixed in V4.3.5617

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Siemens Cerberus PRO UL Compact Panel FC922/924, Cerberus PRO UL Engineering Tool and 4 more products MP4, V4.3.0001

    3 records Highest priority Priority MEDIUM 3 MEDIUM

    Other records, highest priority first

    • TI-2024-14658 Buffer overflow in Siemens Cerberus PRO EN Engineering ToolPriority MEDIUM 50
    • TI-2024-14660 Memory corruption in Siemens Cerberus PRO EN Engineering ToolPriority MEDIUM 41
    Show all 3 records →
  • Release ·

    Siemens Cerberus PRO EN Fire Panel FC72x IP8, Cerberus PRO EN X200 Cloud Distribution IP8 and 4 more products IP8 SR4, MP8 SR4 and 2 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2024-14660 Memory corruption in Siemens Cerberus PRO EN Engineering ToolPriority MEDIUM 41
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-22040
  2. 2026-10-03 Alias added: GHSA-q75q-wf9j-xqjf

References

Other 2

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences