Siemens SiPass integrated up to Mp2.6 AscoServer.exe memory corruption

Summaryinfo

A vulnerability identified as critical has been detected in Siemens SiPass integrated up to Mp2.6. This vulnerability affects unknown code of the file AscoServer.exe. The manipulation leads to memory corruption. This vulnerability is listed as CVE-2012-5409. In addition, an exploit is available.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Siemens SiPass integrated up to Mp2.6. This issue affects some unknown functionality of the file AscoServer.exe. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

AscoServer.exe in the server in Siemens SiPass integrated MP2.6 and earlier does not properly handle IOCP RPC messages received over an Ethernet network, which allows remote attackers to write data to any memory location and consequently execute arbitrary code via crafted messages, as demonstrated by an arbitrary pointer dereference attack or a buffer overflow attack.

The weakness was presented 11/01/2012 (Website). The advisory is shared at siemens.com. The identification of this vulnerability is CVE-2012-5409 since 10/17/2012. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/02/2025).

The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at Exploit-DB (22397), OSVDB (86129†) and Secunia (SA50900†). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Siemens

Name

• SiPass integrated

Version

• Mp2.0
• Mp2.1
• Mp2.2
• Mp2.3
• Mp2.4
• Mp2.5
• Mp2.6

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion