PT-2024-8714 · Siemens · Scalance M812-1 Adsl-Router+15

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-50572

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions RUGGEDCOM RM1224 LTE(4G) EU versions prior to V8.2 RUGGEDCOM RM1224 LTE(4G) NAM versions prior to V8.2 SCALANCE M804PB versions prior to V8.2 SCALANCE M812-1 ADSL-Router versions prior to V8.2 SCALANCE M816-1 ADSL-Router versions prior to V8.2 SCALANCE M826-2 SHDSL-Router versions prior to V8.2 SCALANCE M874-2 versions prior to V8.2 SCALANCE M874-3 versions prior to V8.2 SCALANCE M874-3 3G-Router (CN) versions prior to V8.2 SCALANCE M876-3 versions prior to V8.2 SCALANCE M876-3 (ROK) versions prior to V8.2 SCALANCE M876-4 versions prior to V8.2 SCALANCE M876-4 (EU) versions prior to V8.2 SCALANCE M876-4 (NAM) versions prior to V8.2 SCALANCE MUM853-1 (A1) versions prior to V8.2 SCALANCE MUM853-1 (B1) versions prior to V8.2 SCALANCE MUM853-1 (EU) versions prior to V8.2 SCALANCE MUM856-1 (A1) versions prior to V8.2 SCALANCE MUM856-1 (B1) versions prior to V8.2 SCALANCE MUM856-1 (CN) versions prior to V8.2 SCALANCE MUM856-1 (EU) versions prior to V8.2 SCALANCE MUM856-1 (RoW) versions prior to V8.2 SCALANCE S615 EEC LAN-Router versions prior to V8.2 SCALANCE S615 LAN-Router versions prior to V8.2 SCALANCE WAB762-1 versions prior to V3.0.0 SCALANCE WAM763-1 versions prior to V3.0.0 SCALANCE WAM763-1 (ME) versions prior to V3.0.0 SCALANCE WAM763-1 (US) versions prior to V3.0.0 SCALANCE WAM766-1 versions prior to V3.0.0 SCALANCE WAM766-1 (ME) versions prior to V3.0.0 SCALANCE WAM766-1 (US) versions prior to V3.0.0 SCALANCE WAM766-1 EEC versions prior to V3.0.0 SCALANCE WAM766-1 EEC (ME) versions prior to V3.0.0 SCALANCE WAM766-1 EEC (US) versions prior to V3.0.0 SCALANCE WUB762-1 versions prior to V3.0.0 SCALANCE WUB762-1 iFeatures versions prior to V3.0.0 SCALANCE WUM763-1 versions prior to V3.0.0 SCALANCE WUM763-1 (US) versions prior to V3.0.0 SCALANCE WUM766-1 versions prior to V3.0.0 SCALANCE WUM766-1 (ME) versions prior to V3.0.0 SCALANCE WUM766-1 (USA) versions prior to V3.0.0

Description The issue is related to insufficient input validation in the software of various SCALANCE and RUGGEDCOM devices. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell.

Recommendations Update RUGGEDCOM RM1224 LTE(4G) EU to version V8.2 or newer. Update RUGGEDCOM RM1224 LTE(4G) NAM to version V8.2 or newer. Update SCALANCE M804PB to version V8.2 or newer. Update SCALANCE M812-1 ADSL-Router to version V8.2 or newer. Update SCALANCE M816-1 ADSL-Router to version V8.2 or newer. Update SCALANCE M826-2 SHDSL-Router to version V8.2 or newer. Update SCALANCE M874-2 to version V8.2 or newer. Update SCALANCE M874-3 to version V8.2 or newer. Update SCALANCE M874-3 3G-Router (CN) to version V8.2 or newer. Update SCALANCE M876-3 to version V8.2 or newer. Update SCALANCE M876-3 (ROK) to version V8.2 or newer. Update SCALANCE M876-4 to version V8.2 or newer. Update SCALANCE M876-4 (EU) to version V8.2 or newer. Update SCALANCE M876-4 (NAM) to version V8.2 or newer. Update SCALANCE MUM853-1 (A1) to version V8.2 or newer. Update SCALANCE MUM853-1 (B1) to version V8.2 or newer. Update SCALANCE MUM853-1 (EU) to version V8.2 or newer. Update SCALANCE MUM856-1 (A1) to version V8.2 or newer. Update SCALANCE MUM856-1 (B1) to version V8.2 or newer. Update SCALANCE MUM856-1 (CN) to version V8.2 or newer. Update SCALANCE MUM856-1 (EU) to version V8.2 or newer. Update SCALANCE MUM856-1 (RoW) to version V8.2 or newer. Update SCALANCE S615 EEC LAN-Router to version V8.2 or newer. Update SCALANCE S615 LAN-Router to version V8.2 or newer. Update SCALANCE WAB762-1 to version V3.0.0 or newer. Update SCALANCE WAM763-1 to version V3.0.0 or newer. Update SCALANCE WAM763-1 (ME) to version V3.0.0 or newer. Update SCALANCE WAM763-1 (US) to version V3.0.0 or newer. Update SCALANCE WAM766-1 to version V3.0.0 or newer. Update SCALANCE WAM766-1 (ME) to version V3.0.0 or newer. Update SCALANCE WAM766-1 (US) to version V3.0.0 or newer. Update SCALANCE WAM766-1 EEC to version V3.0.0 or newer. Update SCALANCE WAM766-1 EEC (ME) to version V3.0.0 or newer. Update SCALANCE WAM766-1 EEC (US) to version V3.0.0 or newer. Update SCALANCE WUB762-1 to version V3.0.0 or newer. Update SCALANCE WUB762-1 iFeatures to version V3.0.0 or newer. Update SCALANCE WUM763-1 to version V3.0.0 or newer. Update SCALANCE WUM763-1 (US) to version V3.0.0 or newer. Update SCALANCE WUM766-1 to version V3.0.0 or newer. Update SCALANCE WUM766-1 (ME) to version V3.0.0 or newer. Update SCALANCE WUM766-1 (USA) to version V3.0.0 or newer.

Fix

Special Elements Injection

Command Injection

Weakness Enumeration

CWE-74

CWE-77

Related Identifiers

BDU:2024-10316

CVE-2024-50572

Affected Products

Ruggedcom Rm1224

Scalance M804Pb

Scalance M812-1 Adsl-Router

Scalance M816-1 Adsl-Router

Scalance M826-2 Shdsl-Router

Scalance M874-2

Scalance M874-3

Scalance M874-3 3G-Router

Scalance M876-3

Scalance M876-4

Scalance Mum853-1

Scalance Mum856-1

Scalance S615

Scalance Wab762-1

Scalance Wam763-1

Scalance Wam766-1

References · 9

• https://osv.dev/vulnerability/CVE-2024-50572 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-50572 · Security Note
• https://bdu.fstec.ru/vul/2024-10316 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-354112.html · Vendor Advisory
• https://twitter.com/CveFindCom/status/1856329102032093517 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-769027.html · Note
• https://t.me/cvedetector/10596 · Telegram Post
• https://twitter.com/oktsec/status/1856345659697250619 · Twitter Post
• https://feedly.com/cve/CVE-2024-50572 · Note