PT-2024-7405 · Siemens · Simatic Rf188C+11

Published 2024-09-10 · Updated 2024-09-18 · CVE-2024-37995

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: SIMATIC Reader RF610R CMIIT versions prior to V4.2 SIMATIC Reader RF610R ETSI versions prior to V4.2 SIMATIC Reader RF610R FCC versions prior to V4.2 SIMATIC Reader RF615R CMIIT versions prior to V4.2 SIMATIC Reader RF615R ETSI versions prior to V4.2 SIMATIC Reader RF615R FCC versions prior to V4.2 SIMATIC Reader RF650R ARIB versions prior to V4.2 SIMATIC Reader RF650R CMIIT versions prior to V4.2 SIMATIC Reader RF650R ETSI versions prior to V4.2 SIMATIC Reader RF650R FCC versions prior to V4.2 SIMATIC Reader RF680R ARIB versions prior to V4.2 SIMATIC Reader RF680R CMIIT versions prior to V4.2 SIMATIC Reader RF680R ETSI versions prior to V4.2 SIMATIC Reader RF680R FCC versions prior to V4.2 SIMATIC Reader RF685R ARIB versions prior to V4.2 SIMATIC Reader RF685R CMIIT versions prior to V4.2 SIMATIC Reader RF685R ETSI versions prior to V4.2 SIMATIC Reader RF685R FCC versions prior to V4.2 SIMATIC RF1140R versions prior to V1.1 SIMATIC RF1170R versions prior to V1.1 SIMATIC RF166C versions prior to V2.2 SIMATIC RF185C versions prior to V2.2 SIMATIC RF186C versions prior to V2.2 SIMATIC RF186CI versions prior to V2.2 SIMATIC RF188C versions prior to V2.2 SIMATIC RF188CI versions prior to V2.2 SIMATIC RF360R versions prior to V2.2

Description: The affected application improperly handles errors when a faulty certificate is uploaded, leading to the application crashing. This could allow an attacker to disclose sensitive information. The vulnerability is related to insufficient handling of exceptional states, which can be exploited to cause a denial of service and disclose protected information when an incorrect certificate is uploaded.

Recommendations: For SIMATIC Reader RF610R CMIIT versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF610R ETSI versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF610R FCC versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF615R CMIIT versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF615R ETSI versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF615R FCC versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF650R ARIB versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF650R CMIIT versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF650R ETSI versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF650R FCC versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF680R ARIB versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF680R CMIIT versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF680R ETSI versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF680R FCC versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF685R ARIB versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF685R CMIIT versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF685R ETSI versions prior to V4.2, update to version V4.2 or later. For SIMATIC Reader RF685R FCC versions prior to V4.2, update to version V4.2 or later. For SIMATIC RF1140R versions prior to V1.1, update to version V1.1 or later. For SIMATIC RF1170R versions prior to V1.1, update to version V1.1 or later. For SIMATIC RF166C versions prior to V2.2, update to version V2.2 or later. For SIMATIC RF185C versions prior to V2.2, update to version V2.2 or later. For SIMATIC RF186C versions prior to V2.2, update to version V2.2 or later. For SIMATIC RF186CI versions prior to V2.2, update to version V2.2 or later. For SIMATIC RF188C versions prior to V2.2, update to version V2.2 or later. For SIMATIC RF188CI versions prior to V2.2, update to version V2.2 or later. For SIMATIC RF360R versions prior to V2.2, update to version V2.2 or later.

Fix

Weakness Enumeration

CWE-703

Related Identifiers

BDU:2024-08779

CVE-2024-37995

Affected Products

Simatic Rf1140R

Simatic Rf1170R

Simatic Rf166C

Simatic Rf185C

Simatic Rf186Ci

Simatic Rf188C

Simatic Rf360R

Simatic Reader Rf610R

Simatic Reader Rf615R

Simatic Reader Rf650R

Simatic Reader Rf680R

Simatic Reader Rf685R

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-37995 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-765405.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-08779 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37995 · Vendor Advisory
• https://twitter.com/CVEnew/status/1833443207952109893 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1833501858695880771 · Twitter Post
• https://t.me/cvedetector/5215 · Telegram Post