CVE-2024-37998

CRITICAL

9.8

Beschreibung

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht7/22/2024

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-620

Referenzen

https://cert-portal.siemens.com/productcert/html/ssa-071402.html(productcert@siemens.com)

https://cert-portal.siemens.com/productcert/html/ssa-071402.html(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.