Publication Date: |
|
Last Update: |
|
Current Version: | V1.0 |
CVSS v3.1 Base Score: | 10.0 |
CVSS v4.0 Base Score: | 10.0 |
Affected Product and Versions | Remediation |
---|---|
All versions < V8.2.12 affected by all CVEs |
Update to V8.2.12 or later version
|
All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration) affected by all CVEs |
Update to V7.2.12 or later version
Disable the IP interface
|
Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:
Product-specific remediations or mitigations can be found in the section
Affected Products and Solution.
Please follow the General Security Recommendations.
As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.
This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.
CVSS v3.1 Base Score | 10.0 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
CVSS v4.0 Base Score | 10.0 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
CWE | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
ping
) on operating system level.CVSS v3.1 Base Score | 7.2 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
CVSS v4.0 Base Score | 6.9 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N |
CWE | CWE-306: Missing Authentication for Critical Function |
CVSS v3.1 Base Score | 5.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N |
CVSS v4.0 Base Score | 6.9 |
CVSS v4.0 Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N |
CWE | CWE-250: Execution with Unnecessary Privileges |
CVSS v3.1 Base Score | 7.8 |
CVSS v3.1 Vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v4.0 Base Score | 8.5 |
CVSS v4.0 Vector | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
CWE | CWE-266: Incorrect Privilege Assignment |
Siemens InterMesh Subscriber Devices are brand-labeled devices from AES Corporation (https://aes-corp.com/). Fore more information regarding affected products from AES see their corresponding release notes in the AES knowledge base at: https://aes-corp.my.salesforce.com/sserv/login.jsp?orgId=00D30000000YZKG.
V1.0 (2024-10-23): | Publication Date |