Vulnerability Report

CVE-2018-25032

RCE

Title: Siemens Scalance Sc636-2C RCE

RCE

Proof Of Concept

PoC Available for CVE-2018-25032

CWE Category CWE-787
Published Date Mar 25, 2022
Modified Date Aug 21, 2025
Exploit Status Available
Score 7.5 CVSS v3.1
Exploit Probability (EPSS)
0.09%

Vulnerability Summary

CVE-2018-25032: zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

Impacted Vendors

Z
zlib 1
P
python 1
M
mariadb 1
S
siemens 6
A
azul 1
C
cloudflare 1
P
python_software_foundation 1
N
netapp 11
N
nokogiri 1
G
goto 1
S
sercomm 1

Reference Links

http://seclists.org/fulldisclosure/2022/May/33 http://seclists.org/fulldisclosure/2022/May/35 http://seclists.org/fulldisclosure/2022/May/38 http://www.openwall.com/lists/oss-security/2022/03/25/2 http://www.openwall.com/lists/oss-security/2022/03/26/1 https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 https://github.com/madler/zlib/issues/605 https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/ https://security.gentoo.org/glsa/202210-42 https://security.netapp.com/advisory/ntap-20220526-0009/ https://security.netapp.com/advisory/ntap-20220729-0004/ https://support.apple.com/kb/HT213255 https://support.apple.com/kb/HT213256 https://support.apple.com/kb/HT213257 https://www.debian.org/security/2022/dsa-5111 https://www.openwall.com/lists/oss-security/2022/03/24/1 https://www.openwall.com/lists/oss-security/2022/03/28/1 https://www.openwall.com/lists/oss-security/2022/03/28/3 https://www.oracle.com/security-alerts/cpujul2022.html http://seclists.org/fulldisclosure/2022/May/33 http://seclists.org/fulldisclosure/2022/May/35 http://seclists.org/fulldisclosure/2022/May/38 http://www.openwall.com/lists/oss-security/2022/03/25/2 http://www.openwall.com/lists/oss-security/2022/03/26/1 https://cert-portal.siemens.com/productcert/pdf/ssa-333517.pdf https://github.com/madler/zlib/commit/5c44459c3b28a9bd3283aaceab7c615f8020c531 https://github.com/madler/zlib/compare/v1.2.11...v1.2.12 https://github.com/madler/zlib/issues/605 https://lists.debian.org/debian-lts-announce/2022/04/msg00000.html https://lists.debian.org/debian-lts-announce/2022/05/msg00008.html https://lists.debian.org/debian-lts-announce/2022/09/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DCZFIJBJTZ7CL5QXBFKTQ22Q26VINRUF/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DF62MVMH3QUGMBDCB3DY2ERQ6EBHTADB/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZZPTWRYQULAOL3AW7RZJNVZ2UONXCV4/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NS2D2GFPFGOJUL4WQ3DUAY7HF4VWQ77F/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOKNP2L734AEL47NRYGVZIKEFOUBQY5Y/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOKFMSNQ5D5WGMALBNBXU3GE442V74WU/ https://security.gentoo.org/glsa/202210-42 https://security.netapp.com/advisory/ntap-20220526-0009/ https://security.netapp.com/advisory/ntap-20220729-0004/ https://support.apple.com/kb/HT213255 https://support.apple.com/kb/HT213256 https://support.apple.com/kb/HT213257 https://www.debian.org/security/2022/dsa-5111 https://www.openwall.com/lists/oss-security/2022/03/24/1 https://www.openwall.com/lists/oss-security/2022/03/28/1 https://www.openwall.com/lists/oss-security/2022/03/28/3 https://www.oracle.com/security-alerts/cpujul2022.html
CVSS v3.1
Source Entity [email protected]
Severity HIGH
7.5
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v3.1
Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity HIGH
7.5
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
5.0
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:L/Au:N/C:N/I:N/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2018-25032 Exploits & PoCs (Proof Of Concept)

GitHub https://github.com/Trinadh465/external_zlib_4.4_CVE-2018-25032
View Code
GitHub https://github.com/Satheesh575555/external_zlib-1.2.7_CVE-2018-25032
View Code
GitHub https://github.com/Trinadh465/external_zlib_AOSP10_r33_CVE-2018-25032
View Code
MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Stack

No specific products linked.