PT-2024-8713 · Siemens · Scalance M812-1 Adsl-Router+13

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-50557

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RUGGEDCOM RM1224 LTE(4G) EU versions prior to V8.2 RUGGEDCOM RM1224 LTE(4G) NAM versions prior to V8.2 SCALANCE M804PB versions prior to V8.2 SCALANCE M812-1 ADSL-Router versions prior to V8.2 SCALANCE M816-1 ADSL-Router versions prior to V8.2 SCALANCE M826-2 SHDSL-Router versions prior to V8.2 SCALANCE M874-2 versions prior to V8.2 SCALANCE M874-3 versions prior to V8.2 SCALANCE M874-3 3G-Router (CN) versions prior to V8.2 SCALANCE M876-3 versions prior to V8.2 SCALANCE M876-3 (ROK) versions prior to V8.2 SCALANCE M876-4 versions prior to V8.2 SCALANCE M876-4 (EU) versions prior to V8.2 SCALANCE M876-4 (NAM) versions prior to V8.2 SCALANCE MUM853-1 versions prior to V8.2 SCALANCE MUM856-1 versions prior to V8.2 SCALANCE S615 EEC LAN-Router versions prior to V8.2 SCALANCE S615 LAN-Router versions prior to V8.2

Description The issue is related to insufficient input validation in the configuration field of the iperf functionality, which could allow a remote attacker to execute arbitrary code on the device.

Recommendations As a temporary workaround, consider disabling the iperf functionality until a patch is available. Update to version V8.2 or later for each of the affected devices to resolve the issue. Restrict access to the configuration fields of the iperf functionality to minimize the risk of exploitation. Avoid using the affected devices for critical operations until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-10315

CVE-2024-50557

Affected Products

Ruggedcom Rm1224 Lte(4G) Eu

Ruggedcom Rm1224 Lte(4G) Nam

Scalance M804Pb

Scalance M812-1 Adsl-Router

Scalance M816-1 Adsl-Router

Scalance M826-2 Shdsl-Router

Scalance M874-2

Scalance M874-3

Scalance M874-3 3G-Router

Scalance M876-3

Scalance M876-4

Scalance Mum853-1

Scalance Mum856-1

Scalance S615 Eec Lan-Router

References · 8

• https://bdu.fstec.ru/vul/2024-10315 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-354112.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50557 · Security Note
• https://nvd.nist.gov/vuln/detail/cve-2024-50557 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50557 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1856329142201135453 · Twitter Post
• https://t.me/cvedetector/10598 · Telegram Post
• https://feedly.com/cve/CVE-2024-50557 · Note