CVE-2024-23816: Siemens Location Intelligence Perpetual Large

Описание

Оригинално описание

A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.

Засегнати продукти

• Siemens Location Intelligence Perpetual Large: преди V4.3
• Siemens Location Intelligence Perpetual Medium: преди V4.3
• Siemens Location Intelligence Perpetual Non-Prod: преди V4.3
• Siemens Location Intelligence Perpetual Small: преди V4.3
• Siemens Location Intelligence SUS Large: преди V4.3
• Siemens Location Intelligence SUS Medium: преди V4.3
• Siemens Location Intelligence SUS Non-Prod: преди V4.3
• Siemens Location Intelligence SUS Small: преди V4.3

Вид слабост

• CWE-798 Use of Hard-coded Credentials

История

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2024-23816
• https://nvd.nist.gov/vuln/detail/CVE-2024-23816
• https://cert-portal.siemens.com/productcert/html/ssa-580228.html