PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-1271 Siemens CVE debrief

CVE-2022-1271 is a HIGH severity (CVSS 8.8) arbitrary file write vulnerability in GNU gzip's zgrep utility. The flaw stems from insufficient validation when processing filenames containing two or more newlines, allowing an attacker to embed selected content and target filenames within crafted multi-line filenames. When zgrep processes such a filename, it can be forced to write attacker-controlled content to arbitrary attacker-selected files on the system. This vulnerability enables a remote, low-privileged attacker to achieve arbitrary file writes. The vulnerability was published on 2024-04-09 and last modified on 2025-05-13. Siemens RUGGEDCOM APE1808 is affected, with remediation available through upgrading Palo Alto Networks Virtual NGFW to version V11.1.2-h3.

Vendor
Siemens
Product
RUGGEDCOM APE1808
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-04-09
Original CVE updated
2025-05-13
Advisory published
2024-04-09
Advisory updated
2025-05-13

Who should care

Organizations operating Siemens RUGGEDCOM APE1808 devices with Palo Alto Networks Virtual NGFW deployments should prioritize remediation. Security teams managing industrial control systems, network administrators responsible for ruggedized networking equipment, and incident response teams supporting OT environments should monitor for exploitation attempts. Additionally, any organization utilizing zgrep in automated processing pipelines with untrusted filename inputs should assess exposure.

Technical summary

The vulnerability exists in the zgrep utility's handling of filenames containing multiple newline characters. When zgrep processes a crafted filename with embedded newlines, the insufficient validation allows the attacker to manipulate the output destination, redirecting content to arbitrary files on the filesystem. This is a command injection variant specific to the zgrep implementation, where filename metadata is not properly sanitized before being used in file operations. The attack requires the attacker to influence the filename processed by zgrep, which may occur through various vectors including malicious archives, crafted uploads, or compromised file repositories.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade Palo Alto Networks Virtual NGFW to version V11.1.2-h3 on affected RUGGEDCOM APE1808 devices. Contact Siemens customer support to obtain patch and update information.
  • Apply defense-in-depth strategies for industrial control systems, including network segmentation and restricted access to critical devices.
  • Monitor for anomalous file system activity on systems utilizing zgrep, particularly unexpected file writes.
  • Review and validate filename inputs in automated scripts or applications that invoke zgrep on untrusted data sources.

Evidence notes

The vulnerability description is sourced from CISA CSAF advisory ICSA-24-102-04, which references Siemens security advisory SSA-455250. The affected product is confirmed as Siemens RUGGEDCOM APE1808. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, and high impact across confidentiality, integrity, and availability.

Official resources

This vulnerability was disclosed through CISA ICS advisory ICSA-24-102-04, with Siemens providing product-specific guidance. The underlying GNU gzip vulnerability is a well-documented issue affecting the zgrep utility's filename parsing.