PT-2024-3457 · Siemens · Simatic Cn 4100

Martin Floeck + 1 · Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-32740

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V3.0

Description A vulnerability has been identified in the SIMATIC CN 4100 device, which contains undocumented users and credentials. This issue is related to the use of pre-installed credentials. An attacker could misuse these credentials to compromise the device locally or over the network, potentially allowing a remote attacker to gain full access to the device.

Recommendations For versions prior to V3.0, update to version V3.0 or later to resolve the issue. As a temporary workaround, consider restricting network access to the device and changing any default or pre-installed credentials to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2024-03743

CVE-2024-32740

Affected Products

Simatic Cn 4100

References · 4

• https://cert-portal.siemens.com/productcert/html/ssa-273900.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-32740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32740 · Security Note
• https://bdu.fstec.ru/vul/2024-03743 · Security Note