CVE-2024-21483

A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data.

CVSS v3 4.6 MEDIUM

4.6^/10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 0.9 / Impact : 3.6

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-792319.html
https://cert-portal.siemens.com/productcert/html/ssa-792319.html

Configurations

No configuration.

History

21 Nov 2024, 08:54

Type	Values Removed	Values Added
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-792319.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-792319.html -

10 Sep 2024, 10:15

Type	Values Removed	Values Added
Summary		(es) Se ha identificado una vulnerabilidad en SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (Todas las versiones >= V3.2.3 < V3.3.0 sólo cuando se fabrican entre LQN231003... y LQN231215... ( con LQNYYMMDD... )), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (Todas las versiones >= V3.2.3 < V3.3.0 solo cuando se fabrican entre LQN231003... y LQN231215... (con LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (Todas las versiones >= V3.2.3 < V3.3.0 solo cuando se fabrican entre LQN231003... y LQN231215... (con LQNYYMMDD...)), SENTRON 7KM PAC3220 DC ( 7KM3220-1BA01-1EA0) (Todas las versiones >= V3.2.3 < V3.3.0 solo cuando se fabrican entre LQN231003... y LQN231215... (con LQNYYMMDD...)). La protección de lectura del flash interno de los dispositivos afectados no se configuró correctamente al final del proceso de fabricación. Un atacante con acceso físico al dispositivo podría leer los datos.
Summary	(en) A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.3.0 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data.	(en) A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3120 DC (7KM3120-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 AC/DC (7KM3220-0BA01-1DA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)), SENTRON 7KM PAC3220 DC (7KM3220-1BA01-1EA0) (All versions >= V3.2.3 < V3.2.4 only when manufactured between LQN231003... and LQN231215... ( with LQNYYMMDD...)). The read out protection of the internal flash of affected devices was not properly set at the end of the manufacturing process. An attacker with physical access to the device could read out the data.

12 Mar 2024, 11:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-03-12 11:15

Updated : 2024-11-21 08:54

NVD link : CVE-2024-21483

Mitre link : CVE-2024-21483

CVE.ORG link : CVE-2024-21483

JSON object : View

Products Affected

No product.

CWE

CWE-284

Improper Access Control

4.6 /10