PT-2024-4598 · Powersys · Powersys

Turek Witold · Published 2024-06-11 · Updated 2024-08-17 · CVE-2024-36266

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: PowerSys versions prior to V3.11

Description: A vulnerability has been identified in the affected application, where it insufficiently protects responses to authentication requests. This could allow a local attacker to bypass authentication, thereby gaining administrative privileges for the managed remote devices. The vulnerability is related to deficiencies in the authentication procedure, which may enable an attacker to bypass security restrictions and elevate their privileges.

Recommendations: For PowerSys versions prior to V3.11, update to version V3.11 or later to resolve the issue. As a temporary workaround, consider restricting access to authentication requests to minimize the risk of exploitation. Avoid using the vulnerable authentication mechanism until the issue is resolved.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2024-05106

CVE-2024-36266

Affected Products

Powersys

References · 7

• https://cert-portal.siemens.com/productcert/html/ssa-024584.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-36266 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05106 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-36266 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-165-07 · Note
• https://twitter.com/thecyberwall/status/1825039933544731002 · Twitter Post
• https://feedly.com/cve/CVE-2024-36266 · Note