Multiple vulnerabilities in Siemens Location Intelligence



Published: 2024-08-14
Risk Medium
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2024-41681
CVE-2024-41682
CVE-2024-41683
CWE-ID CWE-326
CWE-307
CWE-521
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Location Intelligence family
Hardware solutions / Firmware

Vendor

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Inadequate Encryption Strength

EUVDB-ID: #VU95993

Risk: Medium

CVSSv3.1: 5.8 [CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41681

CWE-ID: CWE-326 - Inadequate Encryption Strength

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the web server is configured to support weak ciphers by default. A remote attacker on the local network can read and modify any data passed over the connection between legitimate clients and the affected device.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Location Intelligence family: before 4.4

CPE2.3
External links

http://cert-portal.siemens.com/productcert/html/ssa-720392.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Restriction of Excessive Authentication Attempts

EUVDB-ID: #VU95994

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41682

CWE-ID: CWE-307 - Improper Restriction of Excessive Authentication Attempts

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper restriction of excessive authentication attempts. A remote attacker can conduct brute force attacks against legitimate user passwords.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Location Intelligence family: before 4.4

CPE2.3
External links

http://cert-portal.siemens.com/productcert/html/ssa-720392.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Weak password requirements

EUVDB-ID: #VU95995

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-41683

CWE-ID: CWE-521 - Weak Password Requirements

Exploit availability: No

Description

The vulnerability allows an attacker to perform brute-force attack and guess the password.

The vulnerability exists due to weak password requirements. An attacker can perform a brute-force attack and guess users' passwords.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Location Intelligence family: before 4.4

CPE2.3
External links

http://cert-portal.siemens.com/productcert/html/ssa-720392.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###