cvelistv5 - cve-2024-39876

CVE-2024-39876 (GCVE-0-2024-39876)

Vulnerability from cvelistv5 – Published: 2024-07-09 12:05 – Updated: 2025-08-27 20:42

Summary

A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2 SP1). Affected applications do not properly handle log rotation. This could allow an unauthenticated remote attacker to cause a denial of service condition through resource exhaustion on the device.

Severity ?

4 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C

5.3 (Medium)


                        
                          CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CWE

CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

siemens

References

URL

	Vendor	Product	Version
	Siemens	SINEMA Remote Connect Server	Affected: 0 , < V3.2 SP1 (custom)

ICSA-24-193-01

Vulnerability from csaf_cisa - Published: 2024-07-09 00:00 - Updated: 2024-07-09 00:00

Summary

Siemens Remote Connect Server

Notes

Summary

SINEMA Remote Connect Server before V3.2 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.

General Recommendations

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

Siemens Security Advisories are subject to the terms and conditions contained in Siemens' underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter "License Terms"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens' Global Website (https://www.siemens.com/terms_of_use, hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Advisory Conversion Disclaimer

This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.

Critical infrastructure sectors

Multiple

Countries/areas deployed

Worldwide

Company headquarters location

Germany

Recommended Practices

CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.

Recommended Practices

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.

Recommended Practices

Locate control system networks and remote devices behind firewalls and isolate them from business networks.

Recommended Practices

When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.

Recommended Practices

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

Recommended Practices

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Recommended Practices

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SINEMA Remote Connect Server before V3.2 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-381581.json"
      },
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html"
      },
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381581.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-381581.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-193-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-193-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-193-01 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens Remote Connect Server",
    "tracking": {
      "current_release_date": "2024-07-09T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-24-193-01",
      "initial_release_date": "2024-07-09T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-07-09T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV3.2_SP1",
                "product": {
                  "name": "SINEMA Remote Connect Server",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEMA Remote Connect Server"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-32260",
      "cwe": {
        "id": "CWE-286",
        "name": "Incorrect User Management"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authentication bypass in certain scenarios.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2022-32260"
    },
    {
      "cve": "CVE-2024-39865",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of the restored file. This could allow an attacker with access to the backup encryption key to upload malicious files, that could potentially lead to remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39865"
    },
    {
      "cve": "CVE-2024-39866",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with administrative privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39866"
    },
    {
      "cve": "CVE-2024-39867",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit device configuration information of devices for which they have no privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39867"
    },
    {
      "cve": "CVE-2024-39868",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit VxLAN configuration information of networks for which they have no privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39868"
    },
    {
      "cve": "CVE-2024-39869",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected products allow to upload certificates. An authenticated attacker could upload a crafted certificates leading to a permanent denial-of-service situation. In order to recover from such an attack, the offending certificate needs to be removed manually.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39869"
    },
    {
      "cve": "CVE-2024-39870",
      "cwe": {
        "id": "CWE-602",
        "name": "Client-Side Enforcement of Server-Side Security"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of their own scope as well as to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39870"
    },
    {
      "cve": "CVE-2024-39871",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications do not properly separate the rights to edit device settings and to edit settings for communication relations. This could allow an authenticated attacker with the permission to manage devices to gain access to participant groups that the attacked does not belong to.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39871"
    },
    {
      "cve": "CVE-2024-39872",
      "cwe": {
        "id": "CWE-378",
        "name": "Creation of Temporary File With Insecure Permissions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the \u0027Manage firmware updates\u0027 role to escalate their privileges on the underlying OS level.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39872"
    },
    {
      "cve": "CVE-2024-39873",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39873"
    },
    {
      "cve": "CVE-2024-39874",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39874"
    },
    {
      "cve": "CVE-2024-39875",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows authenticated, low privilege users with the \u0027Manage own remote connections\u0027 permission to retrieve details about other users and group memberships.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39875"
    },
    {
      "cve": "CVE-2024-39876",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications do not properly handle log rotation. This could allow an unauthenticated remote attacker to cause a denial of service condition through resource exhaustion on the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ],
      "title": "CVE-2024-39876"
    }
  ]
}

SSA-381581

Vulnerability from csaf_siemens - Published: 2024-07-09 00:00 - Updated: 2024-07-09 00:00

Summary

SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1

Notes

Summary

General Recommendations

Additional Resources

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SINEMA Remote Connect Server before V3.2 SP1 is affected by multiple vulnerabilities.\n\nSiemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html"
      },
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-381581.json"
      },
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381581.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1 - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-381581.txt"
      }
    ],
    "title": "SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1",
    "tracking": {
      "current_release_date": "2024-07-09T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-381581",
      "initial_release_date": "2024-07-09T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-07-09T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "interim",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "All versions \u003c V3.2 SP1",
                "product": {
                  "name": "SINEMA Remote Connect Server",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "SINEMA Remote Connect Server"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-32260",
      "cwe": {
        "id": "CWE-286",
        "name": "Incorrect User Management"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application creates temporary user credentials for UMC (User Management Component) users. An attacker could use these temporary credentials for authentication bypass in certain scenarios.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2022-32260"
    },
    {
      "cve": "CVE-2024-39865",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload encrypted backup files. As part of this backup, files can be restored without correctly checking the path of the restored file. This could allow an attacker with access to the backup encryption key to upload malicious files, that could potentially lead to remote code execution.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39865"
    },
    {
      "cve": "CVE-2024-39866",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows users to upload encrypted backup files. This could allow an attacker with access to the backup encryption key and with the right to upload backup files to create a user with administrative privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39866"
    },
    {
      "cve": "CVE-2024-39867",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit device configuration information of devices for which they have no privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39867"
    },
    {
      "cve": "CVE-2024-39868",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected devices do not properly validate the authentication when performing certain actions in the web interface allowing an unauthenticated attacker to access and edit VxLAN configuration information of networks for which they have no privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39868"
    },
    {
      "cve": "CVE-2024-39869",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected products allow to upload certificates. An authenticated attacker could upload a crafted certificates leading to a permanent denial-of-service situation. In order to recover from such an attack, the offending certificate needs to be removed manually.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39869"
    },
    {
      "cve": "CVE-2024-39870",
      "cwe": {
        "id": "CWE-602",
        "name": "Client-Side Enforcement of Server-Side Security"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected applications can be configured to allow users to manage own users. A local authenticated user with this privilege could use this modify users outside of their own scope as well as to escalate privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39870"
    },
    {
      "cve": "CVE-2024-39871",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications do not properly separate the rights to edit device settings and to edit settings for communication relations. This could allow an authenticated attacker with the permission to manage devices to gain access to participant groups that the attacked does not belong to.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39871"
    },
    {
      "cve": "CVE-2024-39872",
      "cwe": {
        "id": "CWE-378",
        "name": "Creation of Temporary File With Insecure Permissions"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly assign rights to temporary files created during its update process. This could allow an authenticated attacker with the \u0027Manage firmware updates\u0027 role to escalate their privileges on the underlying OS level.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39872"
    },
    {
      "cve": "CVE-2024-39873",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly implement brute force protection against user credentials in its web API. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39873"
    },
    {
      "cve": "CVE-2024-39874",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application does not properly implement brute force protection against user credentials in its Client Communication component. This could allow an attacker to learn user credentials that are vulnerable to brute force attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39874"
    },
    {
      "cve": "CVE-2024-39875",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected application allows authenticated, low privilege users with the \u0027Manage own remote connections\u0027 permission to retrieve details about other users and group memberships.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39875"
    },
    {
      "cve": "CVE-2024-39876",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "summary",
          "text": "Affected applications do not properly handle log rotation. This could allow an unauthenticated remote attacker to cause a denial of service condition through resource exhaustion on the device.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V3.2 SP1 or later version",
          "product_ids": [
            "1"
          ],
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109972765/"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 4.0,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "title": "CVE-2024-39876"
    }
  ]
}

GHSA-76RM-5XVP-J3V7

Vulnerability from github – Published: 2024-07-09 12:30 – Updated: 2024-07-09 12:30

Details

Severity ?

4.0 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

5.3 (Medium)


                  
                    CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-39876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-770"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-07-09T12:15:20Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.2 SP1). Affected applications do not properly handle log rotation. This could allow an unauthenticated remote attacker to cause a denial of service condition through resource exhaustion on the device.",
  "id": "GHSA-76rm-5xvp-j3v7",
  "modified": "2024-07-09T12:30:58Z",
  "published": "2024-07-09T12:30:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39876"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CNVD-2024-31245

Vulnerability from cnvd - Published: 2024-07-11

Title

Siemens SINEMA Remote Connect Server存在未明漏洞（CNVD-2024-31245）

Description

Siemens SINEMA Remote Connect Server是德国西门子（Siemens）公司的一套远程网络管理平台。该平台主要用于远程访问、维护、控制和诊断底层网络。 Siemens SINEMA Remote Connect Server存在安全漏洞，攻击者可利用该漏洞通过设备上的资源耗尽而造成拒绝服务。

Severity

低

Patch Name

Siemens SINEMA Remote Connect Server存在未明漏洞（CNVD-2024-31245）的补丁

Patch Description

Formal description

用户可参考如下供应商提供的安全公告获得补丁信息： https://cert-portal.siemens.com/productcert/html/ssa-381581.html

Reference

https://cert-portal.siemens.com/productcert/html/ssa-381581.html

Impacted products

Name
Siemens SINEMA Remote Connect Server < V3.2 SP1

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2024-39876"
    }
  },
  "description": "Siemens SINEMA Remote Connect Server\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fdc\u7a0b\u7f51\u7edc\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3b\u8981\u7528\u4e8e\u8fdc\u7a0b\u8bbf\u95ee\u3001\u7ef4\u62a4\u3001\u63a7\u5236\u548c\u8bca\u65ad\u5e95\u5c42\u7f51\u7edc\u3002\n\nSiemens SINEMA Remote Connect Server\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u8bbe\u5907\u4e0a\u7684\u8d44\u6e90\u8017\u5c3d\u800c\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u4f9b\u5e94\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u516c\u544a\u83b7\u5f97\u8865\u4e01\u4fe1\u606f\uff1a\r\nhttps://cert-portal.siemens.com/productcert/html/ssa-381581.html",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2024-31245",
  "openTime": "2024-07-11",
  "patchDescription": "Siemens SINEMA Remote Connect Server\u662f\u5fb7\u56fd\u897f\u95e8\u5b50\uff08Siemens\uff09\u516c\u53f8\u7684\u4e00\u5957\u8fdc\u7a0b\u7f51\u7edc\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3b\u8981\u7528\u4e8e\u8fdc\u7a0b\u8bbf\u95ee\u3001\u7ef4\u62a4\u3001\u63a7\u5236\u548c\u8bca\u65ad\u5e95\u5c42\u7f51\u7edc\u3002\r\n\r\nSiemens SINEMA Remote Connect Server\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u901a\u8fc7\u8bbe\u5907\u4e0a\u7684\u8d44\u6e90\u8017\u5c3d\u800c\u9020\u6210\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Siemens SINEMA Remote Connect Server\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-31245\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Siemens SINEMA Remote Connect Server \u003c V3.2 SP1"
  },
  "referenceLink": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html",
  "serverity": "\u4f4e",
  "submitTime": "2024-07-10",
  "title": "Siemens SINEMA Remote Connect Server\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2024-31245\uff09"
}

NCSC-2024-0282

Vulnerability from csaf_ncscnl - Published: 2024-07-09 18:40 - Updated: 2024-07-09 18:40

Summary

Kwetsbaarheden verholpen in Siemens Producten

Notes

The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.

Feiten

Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC en de Engineering Platforms voor diverse systemen.

Interpretaties

De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade: - Denial-of-Service (DoS) - Manipulatie van gegevens - (Remote) code execution (Administrator/Root rechten) - (Remote) code execution (Gebruikersrechten) - Toegang tot systeemgegevens - Toegang tot gevoelige gegevens - Verhoogde gebruikersrechten De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

Oplossingen

Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121

Stack-based Buffer Overflow

CWE-125

Out-of-bounds Read

CWE-1325

Improperly Controlled Sequential Memory Allocation

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-222

Truncation of Security-relevant Information

CWE-266

Incorrect Privilege Assignment

CWE-267

Privilege Defined With Unsafe Actions

CWE-286

Incorrect User Management

CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-326

Inadequate Encryption Strength

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

CWE-378

Creation of Temporary File With Insecure Permissions

CWE-400

Uncontrolled Resource Consumption

CWE-425

Direct Request ('Forced Browsing')

CWE-434

Unrestricted Upload of File with Dangerous Type

CWE-476

NULL Pointer Dereference

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

CWE-502

Deserialization of Untrusted Data

CWE-547

Use of Hard-coded, Security-relevant Constants

CWE-602

Client-Side Enforcement of Server-Side Security

CWE-732

Incorrect Permission Assignment for Critical Resource

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-770

Allocation of Resources Without Limits or Throttling

CWE-787

Out-of-bounds Write

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

CWE-863

Incorrect Authorization

CWE-916

Use of Password Hash With Insufficient Computational Effort

CWE-924

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

JSON

To clipboard

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Siemens heeft kwetsbaarheden verholpen in diverse producten als Mendix, RUGGEDOM, SIMATIC, SINEMA, SIPROTEC en de Engineering Platforms voor diverse systemen.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorie\u00ebn schade:\n\n- Denial-of-Service (DoS)\n- Manipulatie van gegevens\n- (Remote) code execution (Administrator/Root rechten)\n- (Remote) code execution (Gebruikersrechten)\n- Toegang tot systeemgegevens\n- Toegang tot gevoelige gegevens\n- Verhoogde gebruikersrechten\n\nDe kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico\u0027s zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
        "title": "CWE-119"
      },
      {
        "category": "general",
        "text": "Stack-based Buffer Overflow",
        "title": "CWE-121"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Read",
        "title": "CWE-125"
      },
      {
        "category": "general",
        "text": "Improperly Controlled Sequential Memory Allocation",
        "title": "CWE-1325"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      },
      {
        "category": "general",
        "text": "Truncation of Security-relevant Information",
        "title": "CWE-222"
      },
      {
        "category": "general",
        "text": "Incorrect Privilege Assignment",
        "title": "CWE-266"
      },
      {
        "category": "general",
        "text": "Privilege Defined With Unsafe Actions",
        "title": "CWE-267"
      },
      {
        "category": "general",
        "text": "Incorrect User Management",
        "title": "CWE-286"
      },
      {
        "category": "general",
        "text": "Improper Restriction of Excessive Authentication Attempts",
        "title": "CWE-307"
      },
      {
        "category": "general",
        "text": "Inadequate Encryption Strength",
        "title": "CWE-326"
      },
      {
        "category": "general",
        "text": "Exposure of Private Personal Information to an Unauthorized Actor",
        "title": "CWE-359"
      },
      {
        "category": "general",
        "text": "Creation of Temporary File With Insecure Permissions",
        "title": "CWE-378"
      },
      {
        "category": "general",
        "text": "Uncontrolled Resource Consumption",
        "title": "CWE-400"
      },
      {
        "category": "general",
        "text": "Direct Request (\u0027Forced Browsing\u0027)",
        "title": "CWE-425"
      },
      {
        "category": "general",
        "text": "Unrestricted Upload of File with Dangerous Type",
        "title": "CWE-434"
      },
      {
        "category": "general",
        "text": "NULL Pointer Dereference",
        "title": "CWE-476"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
        "title": "CWE-497"
      },
      {
        "category": "general",
        "text": "Deserialization of Untrusted Data",
        "title": "CWE-502"
      },
      {
        "category": "general",
        "text": "Use of Hard-coded, Security-relevant Constants",
        "title": "CWE-547"
      },
      {
        "category": "general",
        "text": "Client-Side Enforcement of Server-Side Security",
        "title": "CWE-602"
      },
      {
        "category": "general",
        "text": "Incorrect Permission Assignment for Critical Resource",
        "title": "CWE-732"
      },
      {
        "category": "general",
        "text": "Improper Check for Unusual or Exceptional Conditions",
        "title": "CWE-754"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
        "title": "CWE-77"
      },
      {
        "category": "general",
        "text": "Allocation of Resources Without Limits or Throttling",
        "title": "CWE-770"
      },
      {
        "category": "general",
        "text": "Out-of-bounds Write",
        "title": "CWE-787"
      },
      {
        "category": "general",
        "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
        "title": "CWE-79"
      },
      {
        "category": "general",
        "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
        "title": "CWE-843"
      },
      {
        "category": "general",
        "text": "Incorrect Authorization",
        "title": "CWE-863"
      },
      {
        "category": "general",
        "text": "Use of Password Hash With Insufficient Computational Effort",
        "title": "CWE-916"
      },
      {
        "category": "general",
        "text": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
        "title": "CWE-924"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-064222.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-088132.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-170375.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-313039.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-364175.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-381581.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-698820.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-722010.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-723487.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-750499.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-779936.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-824889.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-868282.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-883918.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-928781.pdf"
      },
      {
        "category": "external",
        "summary": "Reference - ncscclear; siemens",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-998949.pdf"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Siemens Producten",
    "tracking": {
      "current_release_date": "2024-07-09T18:40:57.534939Z",
      "id": "NCSC-2024-0282",
      "initial_release_date": "2024-07-09T18:40:57.534939Z",
      "revision_history": [
        {
          "date": "2024-07-09T18:40:57.534939Z",
          "number": "0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "jt_open",
            "product": {
              "name": "jt_open",
              "product_id": "CSAFPID-1497083",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:jt_open:0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "mendix_encryption",
            "product": {
              "name": "mendix_encryption",
              "product_id": "CSAFPID-1497113",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:mendix_encryption:v10.0.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "plm_xml_sdk",
            "product": {
              "name": "plm_xml_sdk",
              "product_id": "CSAFPID-1497084",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:plm_xml_sdk:0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ps_iges_parasolid_translator_component",
            "product": {
              "name": "ps_iges_parasolid_translator_component",
              "product_id": "CSAFPID-1464909",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ps_iges_parasolid_translator_component:0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1496944",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497438",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497459",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497481",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497482",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497428",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.5:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497379",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.6:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497388",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.7:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1498045",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.8:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800",
            "product": {
              "name": "ruggedcom_i800",
              "product_id": "CSAFPID-1497498",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800:4.3.9:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800nc",
            "product": {
              "name": "ruggedcom_i800nc",
              "product_id": "CSAFPID-1496945",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800nc:0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom_i800nc",
            "product": {
              "name": "ruggedcom_i800nc",
              "product_id": "CSAFPID-1497536",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom_i800nc:4.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom",
            "product": {
              "name": "ruggedcom",
              "product_id": "CSAFPID-1498050",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom:4.3.0:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom",
            "product": {
              "name": "ruggedcom",
              "product_id": "CSAFPID-1497507",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom:4.3.1:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom",
            "product": {
              "name": "ruggedcom",
              "product_id": "CSAFPID-1498073",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom:4.3.2:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom",
            "product": {
              "name": "ruggedcom",
              "product_id": "CSAFPID-1497596",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom:4.3.3:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom",
            "product": {
              "name": "ruggedcom",
              "product_id": "CSAFPID-1497876",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom:4.3.4:*:*:*:*:*:*:*"
              }
            }
          },
          {
            "category": "product_name",
            "name": "ruggedcom",
            "product": {
              "name": "ruggedcom",
              "product_id": "CSAFPID-1497817",
              "product_identification_helper": {
                "cpe": "cpe:2.3:a:siemens:ruggedcom:4.3.5:*:*:*:*:*:*:*"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-32260",
      "cwe": {
        "id": "CWE-286",
        "name": "Incorrect User Management"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect User Management",
          "title": "CWE-286"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2022-32260",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2022/CVE-2022-32260.json"
        }
      ],
      "title": "CVE-2022-32260"
    },
    {
      "cve": "CVE-2023-7066",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-7066",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-7066.json"
        }
      ],
      "title": "CVE-2023-7066"
    },
    {
      "cve": "CVE-2023-27321",
      "cwe": {
        "id": "CWE-400",
        "name": "Uncontrolled Resource Consumption"
      },
      "notes": [
        {
          "category": "other",
          "text": "Uncontrolled Resource Consumption",
          "title": "CWE-400"
        },
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        },
        {
          "category": "other",
          "text": "Improperly Controlled Sequential Memory Allocation",
          "title": "CWE-1325"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-27321",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-27321.json"
        }
      ],
      "title": "CVE-2023-27321"
    },
    {
      "cve": "CVE-2023-32735",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-32735",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32735.json"
        }
      ],
      "title": "CVE-2023-32735"
    },
    {
      "cve": "CVE-2023-32737",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-32737",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-32737.json"
        }
      ],
      "title": "CVE-2023-32737"
    },
    {
      "cve": "CVE-2023-46720",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-46720",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-46720.json"
        }
      ],
      "title": "CVE-2023-46720"
    },
    {
      "cve": "CVE-2023-48795",
      "cwe": {
        "id": "CWE-222",
        "name": "Truncation of Security-relevant Information"
      },
      "notes": [
        {
          "category": "other",
          "text": "Truncation of Security-relevant Information",
          "title": "CWE-222"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-48795",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-48795.json"
        }
      ],
      "title": "CVE-2023-48795"
    },
    {
      "cve": "CVE-2023-52237",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1496944",
          "CSAFPID-1496945"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-52237",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52237.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1496944",
            "CSAFPID-1496945"
          ]
        }
      ],
      "title": "CVE-2023-52237"
    },
    {
      "cve": "CVE-2023-52238",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive Information to an Unauthorized Actor",
          "title": "CWE-200"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-52238",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52238.json"
        }
      ],
      "title": "CVE-2023-52238"
    },
    {
      "cve": "CVE-2023-52891",
      "cwe": {
        "id": "CWE-1325",
        "name": "Improperly Controlled Sequential Memory Allocation"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improperly Controlled Sequential Memory Allocation",
          "title": "CWE-1325"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-52891",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2023/CVE-2023-52891.json"
        }
      ],
      "title": "CVE-2023-52891"
    },
    {
      "cve": "CVE-2024-21754",
      "cwe": {
        "id": "CWE-916",
        "name": "Use of Password Hash With Insufficient Computational Effort"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Password Hash With Insufficient Computational Effort",
          "title": "CWE-916"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-21754",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-21754.json"
        }
      ],
      "title": "CVE-2024-21754"
    },
    {
      "cve": "CVE-2024-23111",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
          "title": "CWE-79"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-23111",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-23111.json"
        }
      ],
      "title": "CVE-2024-23111"
    },
    {
      "cve": "CVE-2024-26010",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-26010",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-26010.json"
        }
      ],
      "title": "CVE-2024-26010"
    },
    {
      "cve": "CVE-2024-30321",
      "cwe": {
        "id": "CWE-359",
        "name": "Exposure of Private Personal Information to an Unauthorized Actor"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Private Personal Information to an Unauthorized Actor",
          "title": "CWE-359"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-30321",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-30321.json"
        }
      ],
      "title": "CVE-2024-30321"
    },
    {
      "cve": "CVE-2024-32055",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32055",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32055.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32055"
    },
    {
      "cve": "CVE-2024-32056",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Write",
          "title": "CWE-787"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32056",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32056.json"
        }
      ],
      "title": "CVE-2024-32056"
    },
    {
      "cve": "CVE-2024-32057",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
          "title": "CWE-843"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32057",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32057.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32057"
    },
    {
      "cve": "CVE-2024-32058",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer",
          "title": "CWE-119"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32058",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32058.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32058"
    },
    {
      "cve": "CVE-2024-32059",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32059",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32059.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32059"
    },
    {
      "cve": "CVE-2024-32060",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32060",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32060.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32060"
    },
    {
      "cve": "CVE-2024-32061",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32061",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32061.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32061"
    },
    {
      "cve": "CVE-2024-32062",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
          "title": "CWE-843"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32062",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32062.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32062"
    },
    {
      "cve": "CVE-2024-32063",
      "cwe": {
        "id": "CWE-843",
        "name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
          "title": "CWE-843"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32063",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32063.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32063"
    },
    {
      "cve": "CVE-2024-32064",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32064",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32064.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32064"
    },
    {
      "cve": "CVE-2024-32065",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32065",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32065.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32065"
    },
    {
      "cve": "CVE-2024-32066",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1464909"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-32066",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-32066.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1464909"
          ]
        }
      ],
      "title": "CVE-2024-32066"
    },
    {
      "cve": "CVE-2024-33577",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-33577",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33577.json"
        }
      ],
      "title": "CVE-2024-33577"
    },
    {
      "cve": "CVE-2024-33653",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-33653",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33653.json"
        }
      ],
      "title": "CVE-2024-33653"
    },
    {
      "cve": "CVE-2024-33654",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "other",
          "text": "Out-of-bounds Read",
          "title": "CWE-125"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-33654",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-33654.json"
        }
      ],
      "title": "CVE-2024-33654"
    },
    {
      "cve": "CVE-2024-37996",
      "cwe": {
        "id": "CWE-476",
        "name": "NULL Pointer Dereference"
      },
      "notes": [
        {
          "category": "other",
          "text": "NULL Pointer Dereference",
          "title": "CWE-476"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1497083",
          "CSAFPID-1497084"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-37996",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37996.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1497083",
            "CSAFPID-1497084"
          ]
        }
      ],
      "title": "CVE-2024-37996"
    },
    {
      "cve": "CVE-2024-37997",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "other",
          "text": "Stack-based Buffer Overflow",
          "title": "CWE-121"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1497083",
          "CSAFPID-1497084"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-37997",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-37997.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1497083",
            "CSAFPID-1497084"
          ]
        }
      ],
      "title": "CVE-2024-37997"
    },
    {
      "cve": "CVE-2024-38278",
      "cwe": {
        "id": "CWE-266",
        "name": "Incorrect Privilege Assignment"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Privilege Assignment",
          "title": "CWE-266"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38278",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38278.json"
        }
      ],
      "title": "CVE-2024-38278"
    },
    {
      "cve": "CVE-2024-38867",
      "cwe": {
        "id": "CWE-326",
        "name": "Inadequate Encryption Strength"
      },
      "notes": [
        {
          "category": "other",
          "text": "Inadequate Encryption Strength",
          "title": "CWE-326"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38867",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-38867.json"
        }
      ],
      "title": "CVE-2024-38867"
    },
    {
      "cve": "CVE-2024-39567",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39567",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39567.json"
        }
      ],
      "title": "CVE-2024-39567"
    },
    {
      "cve": "CVE-2024-39568",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39568",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39568.json"
        }
      ],
      "title": "CVE-2024-39568"
    },
    {
      "cve": "CVE-2024-39569",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39569",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39569.json"
        }
      ],
      "title": "CVE-2024-39569"
    },
    {
      "cve": "CVE-2024-39570",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39570",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39570.json"
        }
      ],
      "title": "CVE-2024-39570"
    },
    {
      "cve": "CVE-2024-39571",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39571",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39571.json"
        }
      ],
      "title": "CVE-2024-39571"
    },
    {
      "cve": "CVE-2024-39675",
      "cwe": {
        "id": "CWE-497",
        "name": "Exposure of Sensitive System Information to an Unauthorized Control Sphere"
      },
      "notes": [
        {
          "category": "other",
          "text": "Exposure of Sensitive System Information to an Unauthorized Control Sphere",
          "title": "CWE-497"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39675",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39675.json"
        }
      ],
      "title": "CVE-2024-39675"
    },
    {
      "cve": "CVE-2024-39865",
      "cwe": {
        "id": "CWE-434",
        "name": "Unrestricted Upload of File with Dangerous Type"
      },
      "notes": [
        {
          "category": "other",
          "text": "Unrestricted Upload of File with Dangerous Type",
          "title": "CWE-434"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39865",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39865.json"
        }
      ],
      "title": "CVE-2024-39865"
    },
    {
      "cve": "CVE-2024-39866",
      "cwe": {
        "id": "CWE-267",
        "name": "Privilege Defined With Unsafe Actions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Privilege Defined With Unsafe Actions",
          "title": "CWE-267"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39866",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39866.json"
        }
      ],
      "title": "CVE-2024-39866"
    },
    {
      "cve": "CVE-2024-39867",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Direct Request (\u0027Forced Browsing\u0027)",
          "title": "CWE-425"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39867",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39867.json"
        }
      ],
      "title": "CVE-2024-39867"
    },
    {
      "cve": "CVE-2024-39868",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Direct Request (\u0027Forced Browsing\u0027)",
          "title": "CWE-425"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39868",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39868.json"
        }
      ],
      "title": "CVE-2024-39868"
    },
    {
      "cve": "CVE-2024-39869",
      "cwe": {
        "id": "CWE-754",
        "name": "Improper Check for Unusual or Exceptional Conditions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Check for Unusual or Exceptional Conditions",
          "title": "CWE-754"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39869",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39869.json"
        }
      ],
      "title": "CVE-2024-39869"
    },
    {
      "cve": "CVE-2024-39870",
      "cwe": {
        "id": "CWE-602",
        "name": "Client-Side Enforcement of Server-Side Security"
      },
      "notes": [
        {
          "category": "other",
          "text": "Client-Side Enforcement of Server-Side Security",
          "title": "CWE-602"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39870",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39870.json"
        }
      ],
      "title": "CVE-2024-39870"
    },
    {
      "cve": "CVE-2024-39871",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39871",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39871.json"
        }
      ],
      "title": "CVE-2024-39871"
    },
    {
      "cve": "CVE-2024-39872",
      "cwe": {
        "id": "CWE-378",
        "name": "Creation of Temporary File With Insecure Permissions"
      },
      "notes": [
        {
          "category": "other",
          "text": "Creation of Temporary File With Insecure Permissions",
          "title": "CWE-378"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39872",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39872.json"
        }
      ],
      "title": "CVE-2024-39872"
    },
    {
      "cve": "CVE-2024-39873",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of Excessive Authentication Attempts",
          "title": "CWE-307"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39873",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39873.json"
        }
      ],
      "title": "CVE-2024-39873"
    },
    {
      "cve": "CVE-2024-39874",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Restriction of Excessive Authentication Attempts",
          "title": "CWE-307"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39874",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39874.json"
        }
      ],
      "title": "CVE-2024-39874"
    },
    {
      "cve": "CVE-2024-39875",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Permission Assignment for Critical Resource",
          "title": "CWE-732"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39875",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39875.json"
        }
      ],
      "title": "CVE-2024-39875"
    },
    {
      "cve": "CVE-2024-39876",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39876",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39876.json"
        }
      ],
      "title": "CVE-2024-39876"
    },
    {
      "cve": "CVE-2024-39888",
      "cwe": {
        "id": "CWE-547",
        "name": "Use of Hard-coded, Security-relevant Constants"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Hard-coded, Security-relevant Constants",
          "title": "CWE-547"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1497113"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-39888",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-39888.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1497113"
          ]
        }
      ],
      "title": "CVE-2024-39888"
    },
    {
      "cve": "CVE-2024-3596",
      "cwe": {
        "id": "CWE-924",
        "name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel",
          "title": "CWE-924"
        },
        {
          "category": "other",
          "text": "Use of Weak Hash",
          "title": "CWE-328"
        }
      ],
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-3596",
          "url": "https://api.ncsc.nl/velma/v1/vulnerabilities/2024/CVE-2024-3596.json"
        }
      ],
      "title": "CVE-2024-3596"
    }
  ]
}

FKIE_CVE-2024-39876

Vulnerability from fkie_nvd - Published: 2024-07-09 12:15 - Updated: 2024-11-21 09:28

Severity ?

4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
4.0 (Medium) - CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Summary

References

	URL	Tags
	productcert@siemens.com	https://cert-portal.siemens.com/productcert/html/ssa-381581.html	Vendor Advisory
	af854a3a-2127-422b-91ae-364da2661108	https://cert-portal.siemens.com/productcert/html/ssa-381581.html	Vendor Advisory

Impacted products

	Vendor	Product	Version
	siemens	sinema_remote_connect_server	*
	siemens	sinema_remote_connect_server	3.2

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "BA2839E7-E397-4D69-865B-439F0017D540",
              "versionEndExcluding": "3.2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:siemens:sinema_remote_connect_server:3.2:-:*:*:*:*:*:*",
              "matchCriteriaId": "6CBBACB4-9C5A-4616-BD70-FEDEE9978BFC",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in SINEMA Remote Connect Server (All versions \u003c V3.2 SP1). Affected applications do not properly handle log rotation. This could allow an unauthenticated remote attacker to cause a denial of service condition through resource exhaustion on the device."
    },
    {
      "lang": "es",
      "value": "Se ha identificado una vulnerabilidad en SINEMA Remote Connect Server (todas las versiones \u0026lt; V3.2 SP1). Las aplicaciones afectadas no manejan adecuadamente la rotaci\u00f3n de registros. Esto podr\u00eda permitir que un atacante remoto no autenticado provoque una condici\u00f3n de denegaci\u00f3n de servicio mediante el agotamiento de los recursos del dispositivo."
    }
  ],
  "id": "CVE-2024-39876",
  "lastModified": "2024-11-21T09:28:28.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 1.4,
        "source": "productcert@siemens.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.0,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.5,
        "impactScore": 1.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "ADJACENT",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "productcert@siemens.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-07-09T12:15:20.047",
  "references": [
    {
      "source": "productcert@siemens.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-381581.html"
    }
  ],
  "sourceIdentifier": "productcert@siemens.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ],
      "source": "productcert@siemens.com",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-39876 (GCVE-0-2024-39876)

ICSA-24-193-01

SSA-381581

GHSA-76RM-5XVP-J3V7

CNVD-2024-31245

NCSC-2024-0282

FKIE_CVE-2024-39876

Tags

Sightings

Nomenclature