PT-2024-4578 · Unknown · Sinec Traffic Analyzer

Published 2024-06-11 · Updated 2024-08-06 · CVE-2024-35207

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V1.2

Description: A vulnerability has been identified in the web interface of the affected devices, making them susceptible to Cross-Site Request Forgery (CSRF) attacks. By tricking an authenticated victim user into clicking a malicious link, an attacker could perform arbitrary actions on the device on behalf of the victim user.

Recommendations: For versions prior to V1.2, update to version V1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the web interface to minimize the risk of exploitation. Avoid clicking on suspicious links from untrusted sources to prevent potential CSRF attacks.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2024-05084

CVE-2024-35207

Affected Products

Sinec Traffic Analyzer

References · 7

• https://bdu.fstec.ru/vul/2024-05084 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-196737.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-35207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35207 · Security Note
• https://support.industry.siemens.com/cs/document/109954887/sales-delivery-release-of-sinec-traffic-analyzer-v1-2-?dti=0&lc=en-WW · Note
• https://support.industry.siemens.com/cs/document/109954887/sales-delivery-release-of-sinec-traffic-analyzer-v1-2-?dti=0&lc=en-WW · Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-165-13 · Note