PT-2024-7640 · Unknown · Location Intelligence

Published 2024-08-13 · Updated 2024-08-17 · CVE-2024-41681

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Location Intelligence versions prior to V4.4

Description The issue is related to insufficiently strong data encryption. This could allow an unauthenticated attacker in an on-path position to read and modify any data passed over the connection between legitimate clients and the affected device. The web server of affected products is configured to support weak ciphers by default.

Recommendations For versions prior to V4.4, update to version V4.4 or later to resolve the issue. As a temporary workaround, consider reconfiguring the web server to support stronger ciphers until a patch is available. Restrict access to the web server to minimize the risk of exploitation.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2024-09081

CVE-2024-41681

Affected Products

Location Intelligence

References · 8

• https://cert-portal.siemens.com/productcert/html/ssa-720392.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41681 · Security Note
• https://bdu.fstec.ru/vul/2024-09081 · Security Note
• https://osv.dev/vulnerability/CVE-2024-41681 · Vendor Advisory
• https://twitter.com/cracbot/status/1825050049807839588 · Twitter Post
• https://t.me/cvedetector/2983 · Telegram Post
• https://twitter.com/PorsilapongoCl/status/1823274771204714989 · Twitter Post
• https://twitter.com/CVEnew/status/1823272948179853695 · Twitter Post