Vulnerabilites related to Siemens - CPC80 Central Processing/Communication
var-202405-0174
Vulnerability from variot
A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition. SICAM 8 Power automation platform is a universal, all-in-one hardware and software-based solution for all applications in the field of power supply. The SICAM A8000 RTU (Remote Terminal Unit) series is a modular device family for telecontrol and automation applications in all areas of energy supply. SICAM EGS (Enhanced Grid Sensor) is a gateway for local substations in distribution networks
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", affected_products: { "@id": "https://www.variotdbs.pl/ref/affected_products", }, configurations: { "@id": "https://www.variotdbs.pl/ref/configurations", }, credits: { "@id": "https://www.variotdbs.pl/ref/credits", }, cvss: { "@id": "https://www.variotdbs.pl/ref/cvss/", }, description: { "@id": "https://www.variotdbs.pl/ref/description/", }, exploit_availability: { "@id": "https://www.variotdbs.pl/ref/exploit_availability/", }, external_ids: { "@id": "https://www.variotdbs.pl/ref/external_ids/", }, iot: { "@id": "https://www.variotdbs.pl/ref/iot/", }, iot_taxonomy: { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/", }, patch: { "@id": "https://www.variotdbs.pl/ref/patch/", }, problemtype_data: { "@id": "https://www.variotdbs.pl/ref/problemtype_data/", }, references: { "@id": "https://www.variotdbs.pl/ref/references/", }, sources: { "@id": "https://www.variotdbs.pl/ref/sources/", }, sources_release_date: { "@id": "https://www.variotdbs.pl/ref/sources_release_date/", }, sources_update_date: { "@id": "https://www.variotdbs.pl/ref/sources_update_date/", }, threat_type: { "@id": "https://www.variotdbs.pl/ref/threat_type/", }, title: { "@id": "https://www.variotdbs.pl/ref/title/", }, type: { "@id": "https://www.variotdbs.pl/ref/type/", }, }, "@id": "https://www.variotdbs.pl/vuln/VAR-202405-0174", affected_products: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { model: "cpci85 central processing/communication", scope: "lt", trust: 0.6, vendor: "siemens", version: "v5.30", }, { model: "cpc80 central processing/communication", scope: "lt", trust: 0.6, vendor: "siemens", version: "v16.41", }, ], sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, ], }, cve: "CVE-2024-31484", cvss: { "@context": { cvssV2: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2", }, cvssV3: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#", }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/", }, severity: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#", }, "@id": "https://www.variotdbs.pl/ref/cvss/severity", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, "@id": "https://www.variotdbs.pl/ref/sources", }, }, data: [ { cvssV2: [ { accessComplexity: "LOW", accessVector: "LOCAL", authentication: "NONE", author: "CNVD", availabilityImpact: "COMPLETE", baseScore: 7.2, confidentialityImpact: "COMPLETE", exploitabilityScore: 3.9, id: "CNVD-2024-23525", impactScore: 10, integrityImpact: "COMPLETE", severity: "HIGH", trust: 0.6, vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C", version: "2.0", }, ], cvssV3: [ { attackComplexity: "LOW", attackVector: "LOCAL", author: "productcert@siemens.com", availabilityImpact: "HIGH", baseScore: 7.8, baseSeverity: "HIGH", confidentialityImpact: "HIGH", exploitabilityScore: 1.8, impactScore: 5.9, integrityImpact: "HIGH", privilegesRequired: "NONE", scope: "UNCHANGED", trust: 1, userInteraction: "REQUIRED", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, ], severity: [ { author: "productcert@siemens.com", id: "CVE-2024-31484", trust: 1, value: "HIGH", }, { author: "CNVD", id: "CNVD-2024-23525", trust: 0.6, value: "HIGH", }, ], }, ], sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, { db: "NVD", id: "CVE-2024-31484", }, ], }, description: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition. SICAM 8 Power automation platform is a universal, all-in-one hardware and software-based solution for all applications in the field of power supply. The SICAM A8000 RTU (Remote Terminal Unit) series is a modular device family for telecontrol and automation applications in all areas of energy supply. SICAM EGS (Enhanced Grid Sensor) is a gateway for local substations in distribution networks", sources: [ { db: "NVD", id: "CVE-2024-31484", }, { db: "CNVD", id: "CNVD-2024-23525", }, ], trust: 1.44, }, external_ids: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { db: "SIEMENS", id: "SSA-871704", trust: 1.6, }, { db: "NVD", id: "CVE-2024-31484", trust: 1.6, }, { db: "SIEMENS", id: "SSA-620338", trust: 1, }, { db: "CNVD", id: "CNVD-2024-23525", trust: 0.6, }, ], sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, { db: "NVD", id: "CVE-2024-31484", }, ], }, id: "VAR-202405-0174", iot: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: true, sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, ], trust: 0.06, }, iot_taxonomy: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { category: [ "ICS", ], sub_category: null, trust: 0.6, }, ], sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, ], }, last_update_date: "2024-07-04T22:59:37.352000Z", patch: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { title: "Patch for Siemens SICAM products have unspecified vulnerabilities", trust: 0.6, url: "https://www.cnvd.org.cn/patchinfo/show/547196", }, ], sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, ], }, problemtype_data: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { problemtype: "CWE-170", trust: 1, }, ], sources: [ { db: "NVD", id: "CVE-2024-31484", }, ], }, references: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", data: { "@container": "@list", }, sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: [ { trust: 1.6, url: "https://cert-portal.siemens.com/productcert/html/ssa-871704.html", }, { trust: 1, url: "http://seclists.org/fulldisclosure/2024/jul/4", }, { trust: 1, url: "https://cert-portal.siemens.com/productcert/html/ssa-620338.html", }, ], sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, { db: "NVD", id: "CVE-2024-31484", }, ], }, sources: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", data: { "@container": "@list", }, }, data: [ { db: "CNVD", id: "CNVD-2024-23525", }, { db: "NVD", id: "CVE-2024-31484", }, ], }, sources_release_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", data: { "@container": "@list", }, }, data: [ { date: "2024-05-24T00:00:00", db: "CNVD", id: "CNVD-2024-23525", }, { date: "2024-05-14T16:16:50.260000", db: "NVD", id: "CVE-2024-31484", }, ], }, sources_update_date: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", data: { "@container": "@list", }, }, data: [ { date: "2024-05-22T00:00:00", db: "CNVD", id: "CNVD-2024-23525", }, { date: "2024-07-04T07:15:10.583000", db: "NVD", id: "CVE-2024-31484", }, ], }, title: { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", sources: { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", }, }, }, data: "Siemens SICAM products have unspecified vulnerabilities", sources: [ { db: "CNVD", id: "CNVD-2024-23525", }, ], trust: 0.6, }, }
cve-2024-31484
Vulnerability from cvelistv5
Published
2024-05-14 10:02
Modified
2025-02-13 17:47
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
7.3 (High) - CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
7.3 (High) - CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS score ?
Summary
A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Siemens | CPC80 Central Processing/Communication |
Version: 0 < V16.41 |
||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{ containers: { adp: [ { affected: [ { cpes: [ "cpe:2.3:a:siemens:cpc80_central_processing\\/communication:16.41:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "cpc80_central_processing\\/communication", vendor: "siemens", versions: [ { lessThan: "16.41", status: "affected", version: "0", versionType: "custom", }, ], }, { cpes: [ "cpe:2.3:a:siemens:cpci85_central_processing\\/communication:5.30:*:*:*:*:*:*:*", ], defaultStatus: "unknown", product: "cpci85_central_processing\\/communication", vendor: "siemens", versions: [ { lessThan: "5.30", status: "affected", version: "0", versionType: "custom", }, ], }, ], metrics: [ { other: { content: { id: "CVE-2024-31484", options: [ { Exploitation: "none", }, { Automatable: "no", }, { "Technical Impact": "total", }, ], role: "CISA Coordinator", timestamp: "2024-05-28T19:54:51.490746Z", version: "2.0.3", }, type: "ssvc", }, }, ], providerMetadata: { dateUpdated: "2024-06-04T17:36:20.360Z", orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0", shortName: "CISA-ADP", }, title: "CISA ADP Vulnrichment", }, { providerMetadata: { dateUpdated: "2024-11-27T21:02:39.703Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_transferred", ], url: "https://cert-portal.siemens.com/productcert/html/ssa-871704.html", }, { tags: [ "x_transferred", ], url: "https://cert-portal.siemens.com/productcert/html/ssa-620338.html", }, { tags: [ "x_transferred", ], url: "http://seclists.org/fulldisclosure/2024/Jul/4", }, { url: "http://seclists.org/fulldisclosure/2024/Nov/18", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { defaultStatus: "unknown", product: "CPC80 Central Processing/Communication", vendor: "Siemens", versions: [ { lessThan: "V16.41", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "CPCI85 Central Processing/Communication", vendor: "Siemens", versions: [ { lessThan: "V5.30", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "CPCX26 Central Processing/Communication", vendor: "Siemens", versions: [ { lessThan: "V06.02", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "ETA4 Ethernet Interface IEC60870-5-104", vendor: "Siemens", versions: [ { lessThan: "V10.46", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2", vendor: "Siemens", versions: [ { lessThan: "V03.27", status: "affected", version: "0", versionType: "custom", }, ], }, { defaultStatus: "unknown", product: "PCCX26 Ax 1703 PE, Contr, Communication Element", vendor: "Siemens", versions: [ { lessThan: "V06.05", status: "affected", version: "0", versionType: "custom", }, ], }, ], descriptions: [ { lang: "en", value: "A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.", }, ], metrics: [ { cvssV3_1: { baseScore: 7.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", version: "3.1", }, }, { cvssV4_0: { baseScore: 7.3, baseSeverity: "HIGH", vectorString: "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", version: "4.0", }, }, ], problemTypes: [ { descriptions: [ { cweId: "CWE-170", description: "CWE-170: Improper Null Termination", lang: "en", type: "CWE", }, ], }, ], providerMetadata: { dateUpdated: "2024-07-04T06:06:04.302Z", orgId: "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", shortName: "siemens", }, references: [ { url: "https://cert-portal.siemens.com/productcert/html/ssa-871704.html", }, { url: "https://cert-portal.siemens.com/productcert/html/ssa-620338.html", }, { url: "http://seclists.org/fulldisclosure/2024/Jul/4", }, ], }, }, cveMetadata: { assignerOrgId: "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", assignerShortName: "siemens", cveId: "CVE-2024-31484", datePublished: "2024-05-14T10:02:23.871Z", dateReserved: "2024-04-04T11:43:06.066Z", dateUpdated: "2025-02-13T17:47:58.073Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", }