Publication Date:
Last Update:
Current Version: V1.0
CVSS v3.1 Base Score: 10.0
CVSS v4.0 Base Score: 10.0
Un-/Collapse All
Affected Product and Versions Remediation

All versions < V8.2.12
affected by all CVEs

All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)
affected by all CVEs
Update to V7.2.12 or later version
Disable the IP interface
  • Restrict access to the InterMesh network to trusted systems and persons only

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

CVSS v3.1 Base Score 10.0
CVSS v3.1 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0 Base Score 10.0
CVSS v4.0 Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CWE CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVSS v3.1 Base Score 7.2
CVSS v3.1 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0 Base Score 6.9
CVSS v4.0 Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CWE CWE-306: Missing Authentication for Critical Function
CVSS v3.1 Base Score 5.8
CVSS v3.1 Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0 Base Score 6.9
CVSS v4.0 Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
CWE CWE-250: Execution with Unnecessary Privileges
CVSS v3.1 Base Score 7.8
CVSS v3.1 Vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0 Base Score 8.5
CVSS v4.0 Vector CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CWE CWE-266: Incorrect Privilege Assignment

  • AES Corporation for coordination efforts
  • Jean Pereira from CYTRES for reporting the vulnerabilities

Siemens InterMesh Subscriber Devices are brand-labeled devices from AES Corporation (https://aes-corp.com/). Fore more information regarding affected products from AES see their corresponding release notes in the AES knowledge base at: https://aes-corp.my.salesforce.com/sserv/login.jsp?orgId=00D30000000YZKG.

https://www.siemens.com/cert/advisories
V1.0 (2024-10-23): Publication Date