PT-2024-3683 · Siemens · Simatic Rtls Locating Manager

Published 2024-05-14 · Updated 2024-06-11 · CVE-2024-30209

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC RTLS Locating Manager versions prior to V3.0.1.1

Description A vulnerability has been identified that allows an attacker to eavesdrop on and modify resources in transit due to the lack of proper cryptographic protection for client-side resources. This could be exploited by an attacker in the network path between the RTLS Locating Manager server and a client, enabling a man-in-the-middle (MitM) attack.

Recommendations For SIMATIC RTLS Locating Manager versions prior to V3.0.1.1, update to version V3.0.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the network path between the RTLS Locating Manager server and clients to minimize the risk of exploitation.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2024-04027

CVE-2024-30209

Affected Products

Simatic Rtls Locating Manager

References · 3

• https://bdu.fstec.ru/vul/2024-04027 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-30209 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-093430.html · Note