PT-2024-25280 · Siemens · Simatic Rtls Locating Manager
Published
2024-05-14
·
Updated
2024-06-11
·
CVE-2024-33494
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
SIMATIC RTLS Locating Manager versions prior to V3.0.1.1
Description
A vulnerability has been identified where affected components do not properly authenticate heartbeat messages. This could allow an unauthenticated remote attacker to affect the availability of secondary RTLS systems configured using a TeeRevProxy service and potentially cause loss of data generated during the time the attack is ongoing.
Recommendations
For versions prior to V3.0.1.1, update to version V3.0.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the TeeRevProxy service to minimize the risk of exploitation.
Fix
Insufficient Verification of Data Authenticity
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simatic Rtls Locating Manager