Attack Chain

1. The attacker identifies a vulnerable Hirschmann EagleSDV device accessible over the network.
2. The attacker crafts a TLS connection request using TLS 1.0.
3. The attacker sends the crafted TLS 1.0 connection request to the target EagleSDV device.
4. The EagleSDV device attempts to process the TLS 1.0 handshake.
5. Due to the vulnerability, the device encounters an error during the session establishment phase of the TLS handshake.
6. This error leads to uncontrolled resource consumption (CWE-400) within the device’s TLS processing module.
7. The resource exhaustion causes the device’s operating system to become unstable.
8. The device crashes, resulting in a denial-of-service condition.

Impact

Successful exploitation of CVE-2022-4986 leads to a denial-of-service condition on the affected Hirschmann EagleSDV device. This can disrupt network services and cause downtime. The number of affected devices and sectors is unknown, but the impact could be significant for organizations relying on these devices for critical infrastructure.

Recommendation

• Disable TLS 1.0 and TLS 1.1 on all Hirschmann EagleSDV devices to mitigate the vulnerability described in CVE-2022-4986.
• Monitor network traffic for attempts to establish TLS connections using TLS 1.0 and TLS 1.1 to identify potential exploitation attempts using a network monitoring solution (network_connection log source).