SSA-901508

Siemens Security Advisory by Siemens ProductCERT

SSA-901508: Multiple Vulnerabilities in INTRALOG WMS Before V5

Publication Date:	2025-05-13
Last Update:	2025-05-13
Current Version:	V1.0
CVSS v3.1 Base Score:	8.7

SUMMARY

INTRALOG WMS before V5 is affected by multiple vulnerabilities in the Microsoft .NET implementation as described below.

Siemens has released a new version for INTRALOG WMS and recommends to update to the latest version. Please approach your INTRALOG WMS contact to resolve the reported vulnerabilities for your solution. When contacting your Siemens representative, kindly reference the Siemens Security Advisory ID (SSA-901508).

AFFECTED PRODUCTS AND SOLUTION

Un-/Collapse All

Affected Product and Versions	Remediation
INTRALOG WMS All versions < V5 affected by all CVEs CVE-2024-0056 CVE-2024-20672 CVE-2024-30105 CVE-2024-35264 CVE-2024-38081 CVE-2024-38095 CVE-2024-43483 CVE-2024-43485	Update to V5 or later version

WORKAROUNDS AND MITIGATIONS

Product-specific remediations or mitigations can be found in the section Affected Products and Solution.
Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

INTRALOG WMS is a warehouse management solution.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2024-0056

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

CVSS v3.1 Base Score	8.7
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
CWE	CWE-319: Cleartext Transmission of Sensitive Information

Vulnerability CVE-2024-20672

.NET Denial of Service Vulnerability

CVSS v3.1 Base Score	7.5
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-400: Uncontrolled Resource Consumption

Vulnerability CVE-2024-30105

.NET and Visual Studio Denial of Service Vulnerability

CVSS v3.1 Base Score	7.5
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-400: Uncontrolled Resource Consumption

Vulnerability CVE-2024-35264

.NET and Visual Studio Remote Code Execution Vulnerability

CVSS v3.1 Base Score	8.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-416: Use After Free

Vulnerability CVE-2024-38081

.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability

CVSS v3.1 Base Score	7.3
CVSS v3.1 Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE	CWE-59: Improper Link Resolution Before File Access ('Link Following')

Vulnerability CVE-2024-38095

.NET and Visual Studio Denial of Service Vulnerability

CVSS v3.1 Base Score	7.5
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-20: Improper Input Validation

Vulnerability CVE-2024-43483

.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability

CVSS v3.1 Base Score	7.5
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-407: Inefficient Algorithmic Complexity

Vulnerability CVE-2024-43485

.NET and Visual Studio Denial of Service Vulnerability

CVSS v3.1 Base Score	7.5
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE	CWE-407: Inefficient Algorithmic Complexity

ADDITIONAL INFORMATION

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2025-05-13):

Publication Date

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.