PT-2024-4581 · Unknown · Sinec Traffic Analyzer

Published 2024-06-11 · Updated 2024-08-06 · CVE-2024-35210

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V1.2

Description: A vulnerability has been identified in the web server of SINEC Traffic Analyzer, where it is not enforcing HSTS. This could allow an attacker to perform downgrade attacks, exposing confidential information. The vulnerability is related to the transmission of data in plain text, which can be exploited by a remote attacker to execute a downgrade attack.

Recommendations: For versions prior to V1.2, consider enforcing HSTS on the web server to prevent downgrade attacks. As a temporary workaround, restrict access to sensitive information until a patch is available.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2024-05087

CVE-2024-35210

Affected Products

Sinec Traffic Analyzer

References · 6

• https://osv.dev/vulnerability/CVE-2024-35210 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05087 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-196737.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35210 · Security Note
• https://github.com/advisories/GHSA-x8h6-96m2-gv4q · Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-165-13 · Note