The BN_mod_sqrt() function in openSSL, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or explicit elliptic curve parameters with a base point encoded in compressed form. It is possible to trigger the infinite loop by crafting a certificate that has invalid explicit curve parameters. Since certificate parsing happens prior to verification of the certificate signature, any process that parses an externally supplied certificate may thus be subject to a denial of service attack. The infinite loop can also be reached when parsing crafted private keys as they can contain explicit elliptic curve parameters.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Detections

Analytics

Siemens SCALANCE W1750D Command Injection (CVE-2022-0778)

high Tenable OT Security Plugin ID 502170

Version 1.3

Version 1.2

Version 1.1

Version 1.0

Version 1.3 Sep 25, 2025, 12:01 AM Plugin metadata (detection updated) Plugin Feed: 202509250001
Version 1.2 Apr 13, 2024, 2:49 PM New Plugin Feed: 202404131449
Version 1.1 Mar 25, 2024, 1:21 PM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C". "CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") CVSS metrics ("CVSSv2 score" set to 5.0. "CVSSv2 vector" set to "CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:P") Exploit attributes ("Exploit available" set to "True". "Exploitability ease" set to "Exploits are available") CVSSv2 severity (based on CVE-2022-0778, severity decreased from "High" to "Medium") Plugin Feed: 202403251321
Version 1.0 Mar 22, 2024, 12:02 PM New Plugin Feed: 202403221202