PT-2024-4507 · Siemens · Simatic Rtls Locating Manager

Published 2024-05-14 · Updated 2024-07-07 · CVE-2024-33495

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC RTLS Locating Manager versions prior to V3.0.1.1

Description The affected application does not properly limit the size of specific logs, which could allow an unauthenticated remote attacker to exhaust system resources by creating a great number of log entries, potentially leading to a denial of service condition. A successful exploitation requires the attacker to have access to specific SIMATIC RTLS Locating Manager Clients in the deployment.

Recommendations For SIMATIC RTLS Locating Manager versions prior to V3.0.1.1, update to version V3.0.1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected application to minimize the risk of exploitation.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BDU:2024-05011

CVE-2024-33495

Affected Products

Simatic Rtls Locating Manager

References · 4

• https://bdu.fstec.ru/vul/2024-05011 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-33495 · Security Note
• https://twitter.com/oktsec/status/1810149188862107830 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-093430.html · Note