PT-2024-7669 · Siemens · S7-1200 Cpu+2

David Henrique Estevam De Andrade · Published 2024-09-12 · Updated 2024-10-13 · CVE-2024-46886

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SIMATICS7-1500 and S7-1200 CPU family (affected versions not specified)

Description The web server of affected devices does not properly validate input used for user redirection, allowing an attacker to redirect a legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted link. The issue is related to the web server's ability to redirect users to unreliable sites, potentially allowing a remote attacker to redirect users to arbitrary URLs.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2024-09115

CVE-2024-46886

Affected Products

S7-1200 Cpu

S7-1500

Simatic

References · 8

• https://bdu.fstec.ru/vul/2024-09115 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-46886 · Security Note
• https://twitter.com/CVEnew/status/1843575684070846537 · Twitter Post
• https://t.me/cvedetector/7341 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-876787.html · Note
• https://twitter.com/CharyyevPerman/status/1845491649725841650 · Twitter Post
• https://vuldb.com/?id.279609 · Note
• https://vulners.com/cve/CVE-2024-46886 · Note