CVE-2024-31485

🗓️ 14 May 2024 10:02:25Reported by siemensType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 116 Views🌐 WEB

A vulnerability in CPCI85 and SICORE Base system allows authenticated remote attackers to execute arbitrary cod

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	Siemens SICAM Processor Code Execution	24 May 202400:00	–	bdu_fstec
Circl	CVE-2024-31485	26 Jun 202418:00	–	circl
CNNVD	Siemens’ various products have command injection vulnerabilities	14 May 202400:00	–	cnnvd
CNVD	Siemens SICAM Product Command Injection Vulnerability	16 May 202400:00	–	cnvd
Cvelist	CVE-2024-31485	14 May 202410:02	–	cvelist
EUVD	EUVD-2024-29365	3 Oct 202520:07	–	euvd
ICS	Siemens SICAM Products	14 May 202400:00	–	ics
NCSC	Vulnerabilities fixed in Siemens products	14 May 202400:00	–	ncsc
NVD	CVE-2024-31485	14 May 202416:16	–	nvd
Packet Storm	Siemens CP-8000 / CP-8021 / CP8-022 / CP-8031 / CP-8050 / SICORE Buffer Overread / Escalation	4 Jul 202400:00	–	packetstorm

Vulners

Vulnrichment

Node

siemens communicationRange<5.30

siemens sicore_base_systemRange<1.3.0

[
  {
    "vendor": "Siemens",
    "product": "CPCI85 Central Processing/Communication",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V5.30",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "SICORE Base system",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V1.3.0",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-871704.html
seclists	www.seclists.org/fulldisclosure/2024/Jul/4

Parameter	Position	Path	Description	CWE
Session-ID	header	/SICAM_TOOLBOX_1703_remote_connection_00.htm	Buffer overread in the 'Session-ID' HTTP header. If the header is exactly 20 bytes, the server may fail to null-terminate the string, leading to memory leakage from the BSS segment in the response.	CWE-77
p0	request body	/sicweb-ajax/rtum85/cview	Privilege escalation via unencrypted traffic interception. An attacker with viewer privileges can trigger a packet capture on the loopback interface by sending a specific XML request, allowing them to intercept and read all communication, including passwords of higher-privileged users.	CWE-77

17 Jun 2026 07:28Current

7.7High risk

Vulners AI Score7.7

CVSS 3.17.2

CVSS 48.6

EPSS0.02437

SSVC

CWE-77