PT-2024-8120 · Siemens · Scalance M812-1 Adsl-Router+13

Published 2024-08-13 · Updated 2024-08-23 · CVE-2024-41977

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE(4G) EU versions prior to V8.1 RUGGEDCOM RM1224 LTE(4G) NAM versions prior to V8.1 SCALANCE M804PB versions prior to V8.1 SCALANCE M812-1 ADSL-Router family versions prior to V8.1 SCALANCE M816-1 ADSL-Router family versions prior to V8.1 SCALANCE M826-2 SHDSL-Router versions prior to V8.1 SCALANCE M874-2 versions prior to V8.1 SCALANCE M874-3 versions prior to V8.1 SCALANCE M874-3 3G-Router (CN) versions prior to V8.1 SCALANCE M876-3 versions prior to V8.1 SCALANCE M876-3 (ROK) versions prior to V8.1 SCALANCE M876-4 versions prior to V8.1 SCALANCE M876-4 (EU) versions prior to V8.1 SCALANCE M876-4 (NAM) versions prior to V8.1 SCALANCE MUM853-1 (A1) versions prior to V8.1 SCALANCE MUM853-1 (B1) versions prior to V8.1 SCALANCE MUM853-1 (EU) versions prior to V8.1 SCALANCE MUM856-1 (A1) versions prior to V8.1 SCALANCE MUM856-1 (B1) versions prior to V8.1 SCALANCE MUM856-1 (CN) versions prior to V8.1 SCALANCE MUM856-1 (EU) versions prior to V8.1 SCALANCE MUM856-1 (RoW) versions prior to V8.1 SCALANCE S615 EEC LAN-Router versions prior to V8.1 SCALANCE S615 LAN-Router versions prior to V8.1

Description: The affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices. The issue is related to the exposure of user session data to wrong sessions.

Recommendations: For all affected versions, upgrade the components to version V8.1 or later to mitigate the risks. As a temporary workaround, consider restricting access to the web server component until a patch is available. Avoid using sensitive operations in the affected devices until the issue is resolved. At the moment, there is no information about additional mitigation measures.

Fix

Weakness Enumeration

CWE-488

Related Identifiers

BDU:2024-09652

CVE-2024-41977

Affected Products

Ruggedcom Rm1224 Lte(4G) Eu

Ruggedcom Rm1224 Lte(4G) Nam

Scalance M804Pb

Scalance M812-1 Adsl-Router

Scalance M816-1 Adsl-Router

Scalance M826-2 Shdsl-Router

Scalance M874-2

Scalance M874-3

Scalance M874-3 3G-Router

Scalance M876-3

Scalance M876-4

Scalance Mum853-1

Scalance Mum856-1

Scalance S615 Eec Lan-Router

References · 6

• https://osv.dev/vulnerability/CVE-2024-41977 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-087301.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-09652 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-41977 · Security Note
• https://twitter.com/cracbot/status/1825050060889165854 · Twitter Post
• https://twitter.com/oktsec/status/1824857270464721058 · Twitter Post