PT-2024-31661 · Msa · Fieldserver Gateway

Published 2024-12-10 · Updated 2024-12-17 · CVE-2024-45494

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: MSA FieldServer Gateway versions 5.0.0 through 6.5.2

Description: An issue was discovered in the FieldServer Gateway, where an internally used shared administrative user account is present on all devices. The authentication for this user is implemented through an unsafe shared secret that is static in all affected firmware versions.

Recommendations: For versions 5.0.0 through 6.5.2, update to version 7.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the shared administrative user account until the update can be applied.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2024-45494

Affected Products

Fieldserver Gateway

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-45494 · Security Note
• https://us.msasafety.com/fieldserver · Note
• https://twitter.com/CVEnew/status/1866525439562485934 · Twitter Post
• https://t.me/cvedetector/12527 · Telegram Post
• https://us.msasafety.com/security-notices · Note