Devices vulnerable to attack through web server component

CVE-2024-41977

Summary

A significant vulnerability has been discovered that affects multiple Siemens RUGGEDCOM and SCALANCE devices. The devices fail to enforce proper isolation between user sessions in their web server component. This oversight could potentially allow an authenticated remote attacker to escalate their privileges, thereby gaining unauthorized access to sensitive information or executing harmful commands on the affected devices. As a precaution, users are urged to update their systems to version 8.1 or later to mitigate this risk.

References