CVE-2024-41683

A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://cert-portal.siemens.com/productcert/html/ssa-720392.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:siemens:location_intelligence:*:*:*:*:*:*:*:*

History

14 Aug 2024, 18:38

Type	Values Removed	Values Added
CPE		cpe:2.3:a:siemens:location_intelligence::::::::
Summary		(es) Se ha identificado una vulnerabilidad en la familia Location Intelligence (todas las versiones < V4.4). Los productos afectados no aplican adecuadamente una política de contraseñas de usuario seguras. Esto podría facilitar un ataque de fuerza bruta contra contraseñas de usuarios legítimos.
First Time		Siemens location Intelligence Siemens
References	~~() https://cert-portal.siemens.com/productcert/html/ssa-720392.html -~~	() https://cert-portal.siemens.com/productcert/html/ssa-720392.html - Vendor Advisory

13 Aug 2024, 08:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-08-13 08:15

Updated : 2024-08-14 18:38

NVD link : CVE-2024-41683

Mitre link : CVE-2024-41683

CVE.ORG link : CVE-2024-41683

JSON object : View

Products Affected

siemens

location_intelligence

CWE

CWE-521

Weak Password Requirements

{"id": "CVE-2024-41683", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "productcert@siemens.com", "cvssData": {"safety": "NOT_DEFINED", "version": "4.0", "recovery": "NOT_DEFINED", "baseScore": 6.9, "automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "modifiedAttackVector": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subsequentSystemIntegrity": "NONE", "vulnerableSystemIntegrity": "NONE", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "confidentialityRequirements": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "vulnerableSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "vulnerableSystemConfidentiality": "LOW", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED"}}]}, "published": "2024-08-13T08:15:12.440", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-720392.html", "tags": ["Vendor Advisory"], "source": "productcert@siemens.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "productcert@siemens.com", "description": [{"lang": "en", "value": "CWE-521"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Location Intelligence family (All versions < V4.4). Affected products do not properly enforce a strong user password policy. This could facilitate a brute force attack against legitimate user passwords."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en la familia Location Intelligence (todas las versiones < V4.4). Los productos afectados no aplican adecuadamente una pol\u00edtica de contrase\u00f1as de usuario seguras. Esto podr\u00eda facilitar un ataque de fuerza bruta contra contrase\u00f1as de usuarios leg\u00edtimos."}], "lastModified": "2024-08-14T18:38:26.757", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:siemens:location_intelligence:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9B9A8802-FE66-4380-AF01-A2D746B06205", "versionEndExcluding": "4.4"}], "operator": "OR"}]}], "sourceIdentifier": "productcert@siemens.com"}