CVE-2024-23816

A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-580228.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:location_intelligence:*:*:*:*:*:*:*:*

History

22 Oct 2024, 13:10

Type	Values Removed	Values Added
First Time		Siemens Siemens location Intelligence
CPE		cpe:2.3:a:siemens:location_intelligence::::::::
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-580228.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-580228.html - Vendor Advisory

13 Feb 2024, 09:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-13 09:15

Updated : 2024-10-22 13:10

NVD link : CVE-2024-23816

Mitre link : CVE-2024-23816

CVE.ORG link : CVE-2024-23816

JSON object : View

Products Affected

siemens

location_intelligence

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2024-23816", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-02-13T09:15:50.343", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en: \nLocation Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (Todas las versiones < V4.3), \nLocation Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (Todas las versiones < V4.3), \nLocation Intelligence Perpetual Non -Prod (9DE5110-8CA10-1AX0) (todas las versiones < V4.3), \nLocation Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (todas las versiones < V4.3), \nLocation Intelligence SUS Large (9DE5110-8CA13-1BX0) ( Todas las versiones < V4.3), \nLocation Intelligence SUS Medium (9DE5110-8CA12-1BX0) (Todas las versiones < V4.3), \nLocation Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (Todas las versiones < V4.3), \nLocation Intelligence SUS Small (9DE5110-8CA11-1BX0) (Todas las versiones < V4.3). \nLos productos afectados utilizan un valor secreto codificado para el c\u00e1lculo de un c\u00f3digo de autenticaci\u00f3n de mensaje hash con clave. Esto podr\u00eda permitir que un atacante remoto no autenticado obtenga acceso administrativo completo a la aplicaci\u00f3n."}], "lastModified": "2024-10-22T13:10:07.333", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:location_intelligence:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30C51EBA-660C-4920-89FB-5A72F545E737", "versionEndExcluding": "4.3"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}