CVE-2024-31484

🗓️ 14 May 2024 10:02:23Reported by siemensType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 69 Views🌐 WEB

Vulnerability in CPC80 & CPCI85 firmware

Reporter	Title	Published	Views	Family All 16
BDU FSTEC	The vulnerability of the microprogramming software of Siemens SICAM’s CPCI85 and CPC80 control modules allows a hacker to execute arbitrary code or cause malfunctions during maintenance operations.	24 May 202400:00	–	bdu_fstec
Circl	CVE-2024-31484	26 Jun 202418:00	–	circl
CNNVD	Siemens 多款产品安全漏洞	14 May 202400:00	–	cnnvd
CNVD	Unspecified Vulnerability in Siemens SICAM Products	16 May 202400:00	–	cnvd
Cvelist	CVE-2024-31484	14 May 202410:02	–	cvelist
EUVD	EUVD-2024-29364	3 Oct 202520:07	–	euvd
ICS	Siemens SICAM Products	14 May 202400:00	–	ics
ICS	Siemens SICAM AK3/BC/TM	11 Jun 202400:00	–	ics
NCSC	Vulnerabilities fixed in Siemens products	14 May 202400:00	–	ncsc
NCSC	Vulnerabilities fixed in Siemens products	11 Jun 202413:29	–	ncsc

[
  {
    "vendor": "Siemens",
    "product": "CPC80 Central Processing/Communication",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V16.41",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "CPCI85 Central Processing/Communication",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V5.30",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "CPCX26 Central Processing/Communication",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V06.02",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "ETA4 Ethernet Interface IEC60870-5-104",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V10.46",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V03.27",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "PCCX26 Ax 1703 PE, Contr, Communication Element",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V06.05",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-871704.html
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-620338.html
seclists	www.seclists.org/fulldisclosure/2024/Jul/4
seclists	www.seclists.org/fulldisclosure/2024/Nov/18

Parameter	Position	Path	Description	CWE
Session-ID	header	SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread via HTTP header Session-ID in POST to SICAM_TOOLBOX_1703_remote_connection_00.htm	CWE-170
Sequence-ID	header	SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread via HTTP header Session-ID in POST to SICAM_TOOLBOX_1703_remote_connection_00.htm	CWE-170
Content-Length	header	SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread via HTTP header Session-ID in POST to SICAM_TOOLBOX_1703_remote_connection_00.htm	CWE-170
Content-Type	header	SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread via HTTP header Session-ID in POST to SICAM_TOOLBOX_1703_remote_connection_00.htm	CWE-170
KeepAlive	header	SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread via HTTP header Session-ID in POST to SICAM_TOOLBOX_1703_remote_connection_00.htm	CWE-170
Connection	header	SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread via HTTP header Session-ID in POST to SICAM_TOOLBOX_1703_remote_connection_00.htm	CWE-170
Cmd_SetCustomViewValue	request body	sicweb-ajax/rtum85/cview	Privilege escalation by intercepting unencrypted traffic to dump sensitive data via RTUM85 cview endpoint	CWE-170
view	request body	sicweb-ajax/rtum85/cview	Privilege escalation by intercepting unencrypted traffic to dump sensitive data via RTUM85 cview endpoint	CWE-170
parameter	request body	sicweb-ajax/rtum85/cview	Privilege escalation by intercepting unencrypted traffic to dump sensitive data via RTUM85 cview endpoint	CWE-170
id	request body	sicweb-ajax/rtum85/cview	Privilege escalation by intercepting unencrypted traffic to dump sensitive data via RTUM85 cview endpoint	CWE-170

17 Jun 2026 07:28Current

7.6High risk

Vulners AI Score7.6

CVSS 47.3

CVSS 3.17.8

EPSS0.00468

SSVC

CWE-170