Affected applications do not authenticate the creation of Ajax2App instances
CVE-2024-37993

7.5HIGH

Key Information:

Vendor
Siemens
Status
Simatic Reader Rf610r Cmiit
Simatic Reader Rf610r Etsi
Simatic Reader Rf610r Fcc
Simatic Reader Rf615r Cmiit
Vendor
CVE Published:
10 September 2024

Summary

A vulnerability has been identified in several SIMATIC Reader products by Siemens, specifically in versions prior to V4.2. The flaw resides in the lack of authentication for the creation of Ajax2App instances. As a result, an unauthenticated attacker can exploit this vulnerability, potentially leading to a denial of service condition, thereby disrupting the normal operational capabilities of the affected devices.

Affected Version(s)

SIMATIC Reader RF610R CMIIT 0

SIMATIC Reader RF610R ETSI 0

SIMATIC Reader RF610R FCC 0

References

https://cert-portal.siemens.com/productcert/html/ssa-7654...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.