Authentication Bypass in InterMesh Hybrid and Fire Subscriber Products by Siemens
CVE-2024-47902

9.8CRITICAL

Key Information:

Vendor
Siemens
Status
Intermesh 7177 Hybrid 2.0 Subscriber
Vendor
CVE Published:
23 October 2024

Summary

A significant vulnerability has been identified in the web server components of Siemens' InterMesh 7177 Hybrid 2.0 Subscriber and InterMesh 7707 Fire Subscriber products. Specifically, the issue arises from inadequate authentication for GET requests that allow the execution of operating system-level commands such as 'ping'. This vulnerability affects all versions of InterMesh 7177 Hybrid prior to V8.2.12, and specifically the InterMesh 7707 Fire Subscriber versions prior to V7.2.12 when the IP interface is enabled, which is not the default setting. This oversight could lead to unauthorized access and potentially exploit the underlying system.

References

https://cert-portal.siemens.com/productcert/html/ssa-3334...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

.