PT-2024-8717 · Siemens · Sinec Nms

Thomas Riedmaier · Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-47808

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions SINEC NMS versions prior to V3.0 SP1

Description A vulnerability has been identified in the affected application, which contains a database function that does not properly restrict the permissions of users to write to the filesystem of the host system. This could allow an authenticated medium-privileged attacker to write arbitrary content to any location in the filesystem of the host system. The issue is related to the incorrect assignment of permissions for a critical resource, allowing an attacker to record arbitrary data in any location of the host's file system.

Recommendations For versions prior to V3.0 SP1, update to the latest version immediately to stay protected. As a temporary workaround, consider restricting access to the database function to minimize the risk of exploitation. Avoid using the vulnerable database function until the issue is resolved.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2024-10320

CVE-2024-47808

Affected Products

Sinec Nms

References · 7

• https://bdu.fstec.ru/vul/2024-10320 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-331112.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47808 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47808 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1856329213093060749 · Twitter Post
• https://t.me/cvedetector/10606 · Telegram Post
• https://twitter.com/CVEnew/status/1856321748045574479 · Twitter Post