PT-2024-8706 · Unknown · Spectrum Power 7

Dimitri Lesy + 1 · Published 2024-11-12 · Updated 2024-11-17 · CVE-2024-29119

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Spectrum Power 7 versions prior to V24Q3

Description A vulnerability has been identified in the affected product, which contains several root-owned SUID binaries. This could allow an authenticated local attacker to escalate privileges. The issue is related to the incorrect assignment of privileges through the execution of SUID binaries.

Recommendations For versions prior to V24Q3, consider restricting access to the root-owned SUID binaries as a temporary workaround until a patch is available. Additionally, review and adjust the privileges assigned to these binaries to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

BDU:2024-10308

CVE-2024-29119

Affected Products

Spectrum Power 7

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-29119 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-616032.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10308 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29119 · Vendor Advisory
• https://twitter.com/cracbot/status/1858027354456793462 · Twitter Post
• https://twitter.com/CveFindCom/status/1856329382576439383 · Twitter Post
• https://twitter.com/CVEnew/status/1856321761270186387 · Twitter Post