PT-2024-8729 · Siemens · Scalance M812-1+14

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-50560

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions RUGGEDCOM RM1224 LTE(4G) EU versions < V8.2 RUGGEDCOM RM1224 LTE(4G) NAM versions < V8.2 SCALANCE M804PB versions < V8.2 SCALANCE M812-1 ADSL-Router versions < V8.2 SCALANCE M816-1 ADSL-Router versions < V8.2 SCALANCE M826-2 SHDSL-Router versions < V8.2 SCALANCE M874-2 versions < V8.2 SCALANCE M874-3 versions < V8.2 SCALANCE M874-3 3G-Router (CN) versions < V8.2 SCALANCE M876-3 versions < V8.2 SCALANCE M876-4 versions < V8.2 SCALANCE MUM853-1 versions < V8.2 SCALANCE MUM856-1 versions < V8.2 SCALANCE S615 EEC LAN-Router versions < V8.2 SCALANCE S615 LAN-Router versions < V8.2 SCALANCE WAB762-1 versions < V3.0.0 SCALANCE WAM763-1 versions < V3.0.0 SCALANCE WAM766-1 versions < V3.0.0 SCALANCE WUB762-1 versions < V3.0.0 SCALANCE WUM763-1 versions < V3.0.0 SCALANCE WUM766-1 versions < V3.0.0

Description A vulnerability has been identified in the listed devices, where usernames longer than 15 characters are truncated when accessed via SSH or Telnet. This could allow an attacker to compromise system integrity. The issue is related to the incorrect handling of usernames containing more than 15 characters, which are not fully read when accessed through SSH or Telnet.

Recommendations For RUGGEDCOM RM1224 LTE(4G) EU versions < V8.2, update to version V8.2 or later. For RUGGEDCOM RM1224 LTE(4G) NAM versions < V8.2, update to version V8.2 or later. For SCALANCE M804PB versions < V8.2, update to version V8.2 or later. For SCALANCE M812-1 ADSL-Router versions < V8.2, update to version V8.2 or later. For SCALANCE M816-1 ADSL-Router versions < V8.2, update to version V8.2 or later. For SCALANCE M826-2 SHDSL-Router versions < V8.2, update to version V8.2 or later. For SCALANCE M874-2 versions < V8.2, update to version V8.2 or later. For SCALANCE M874-3 versions < V8.2, update to version V8.2 or later. For SCALANCE M874-3 3G-Router (CN) versions < V8.2, update to version V8.2 or later. For SCALANCE M876-3 versions < V8.2, update to version V8.2 or later. For SCALANCE M876-4 versions < V8.2, update to version V8.2 or later. For SCALANCE MUM853-1 versions < V8.2, update to version V8.2 or later. For SCALANCE MUM856-1 versions < V8.2, update to version V8.2 or later. For SCALANCE S615 EEC LAN-Router versions < V8.2, update to version V8.2 or later. For SCALANCE S615 LAN-Router versions < V8.2, update to version V8.2 or later. For SCALANCE WAB762-1 versions < V3.0.0, update to version V3.0.0 or later. For SCALANCE WAM763-1 versions < V3.0.0, update to version V3.0.0 or later. For SCALANCE WAM766-1 versions < V3.0.0, update to version V3.0.0 or later. For SCALANCE WUB762-1 versions < V3.0.0, update to version V3.0.0 or later. For SCALANCE WUM763-1 versions < V3.0.0, update to version V3.0.0 or later. For SCALANCE WUM766-1 versions < V3.0.0, update to version V3.0.0 or later. As a temporary workaround, consider restricting access to SSH and Telnet until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-10333

CVE-2024-50560

Affected Products

Ruggedcom Rm1224

Scalance M804Pb

Scalance M812-1

Scalance M816-1

Scalance M826-2

Scalance M874-2

Scalance M874-3

Scalance M876-3

Scalance M876-4

Scalance Mum853-1

Scalance Mum856-1

Scalance S615

Scalance Wab762-1

Scalance Wam763-1

Scalance Wam766-1

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-50560 · Security Note
• https://osv.dev/vulnerability/CVE-2024-50560 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-354112.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10333 · Security Note
• https://cert-portal.siemens.com/productcert/html/ssa-769027.html · Note
• https://t.me/cvedetector/10601 · Telegram Post