Authentication Bypass in InterMesh Hybrid and Fire Subscriber Products by Siemens
CVE-2024-47902

9.8CRITICAL

Key Information:

Vendor

Siemens
Status
Intermesh 7177 Hybrid 2.0 Subscriber
Vendor
CVE Published:
23 October 2024

What is CVE-2024-47902?

A significant vulnerability has been identified in the web server components of Siemens' InterMesh 7177 Hybrid 2.0 Subscriber and InterMesh 7707 Fire Subscriber products. Specifically, the issue arises from inadequate authentication for GET requests that allow the execution of operating system-level commands such as 'ping'. This vulnerability affects all versions of InterMesh 7177 Hybrid prior to V8.2.12, and specifically the InterMesh 7707 Fire Subscriber versions prior to V7.2.12 when the IP interface is enabled, which is not the default setting. This oversight could lead to unauthorized access and potentially exploit the underlying system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://cert-portal.siemens.com/productcert/html/ssa-3334...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.