PT-2024-4509 · Siemens · Simatic Rtls Locating Manager

Published 2024-05-14 · Updated 2024-06-11 · CVE-2024-33583

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC RTLS Locating Manager versions prior to V3.0.1.1

Description The issue is related to the presence of undocumented configuration commands in the software. Exploitation of this issue could allow an attacker to gain information about the system's configuration. The affected application contains a hidden configuration item that enables debug functionality, which could allow an authenticated local attacker to gain insight into the internal configuration of the deployment.

Recommendations For SIMATIC RTLS Locating Manager versions prior to V3.0.1.1, update to version V3.0.1.1 or later to resolve the issue. As a temporary workaround, consider disabling the debug functionality until a patch is available. Restrict access to the configuration items to minimize the risk of exploitation.

Fix

Hidden Functionality

Weakness Enumeration

CWE-912

Related Identifiers

BDU:2024-05013

CVE-2024-33583

Affected Products

Simatic Rtls Locating Manager

References · 3

• https://bdu.fstec.ru/vul/2024-05013 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-33583 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-093430.html · Note