Lucene search

SiemensCVELIST:CVE-2024-23816

HistoryFeb 13, 2024 - 9:00 a.m.

CVE-2024-23816

2024-02-1309:00:27

CWE-798

siemens

www.cve.org

vulnerability

hard-coded secret

administrative access

location intelligence products

remote attacker

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.

CNA Affected

[
  {
    "vendor": "Siemens",
    "product": "Location Intelligence Perpetual Large",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence Perpetual Medium",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence Perpetual Non-Prod",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence Perpetual Small",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence SUS Large",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence SUS Medium",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence SUS Non-Prod",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "vendor": "Siemens",
    "product": "Location Intelligence SUS Small",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "V4.3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unknown"
  }
]

References

cert-portal.siemens.com/productcert/html/ssa-580228.html

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C

AI Score

9.7

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

Related for CVELIST:CVE-2024-23816