Към съдържанието
Търсене

CVE-2024-44102: Siemens PP TeleControl Server Basic 1000 to 5000 V3.1

10.0

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

A vulnerability has been identified in PP TeleControl Server Basic 1000 to 5000 V3.1 (6NH9910-0AA31-0AE1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 256 to 1000 V3.1 (6NH9910-0AA31-0AD1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 32 to 64 V3.1 (6NH9910-0AA31-0AF1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 64 to 256 V3.1 (6NH9910-0AA31-0AC1) (All versions < V3.1.2.1 with redundancy configured), PP TeleControl Server Basic 8 to 32 V3.1 (6NH9910-0AA31-0AB1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 1000 V3.1 (6NH9910-0AA31-0AD0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 256 V3.1 (6NH9910-0AA31-0AC0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 32 V3.1 (6NH9910-0AA31-0AF0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 5000 V3.1 (6NH9910-0AA31-0AE0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 64 V3.1 (6NH9910-0AA31-0AB0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic 8 V3.1 (6NH9910-0AA31-0AA0) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Serv Upgr (6NH9910-0AA31-0GA1) (All versions < V3.1.2.1 with redundancy configured), TeleControl Server Basic Upgr V3.1 (6NH9910-0AA31-0GA0) (All versions < V3.1.2.1 with redundancy configured). The affected system allows remote users to send maliciously crafted objects. Due to insecure deserialization of user-supplied content by the affected software, an unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted serialized object. This could allow the attacker to execute arbitrary code on the device with SYSTEM privileges.

Засегнати продукти

  • Siemens PP TeleControl Server Basic 1000 to 5000 V3.1: преди V3.1.2.1
  • Siemens PP TeleControl Server Basic 256 to 1000 V3.1: преди V3.1.2.1
  • Siemens PP TeleControl Server Basic 32 to 64 V3.1: преди V3.1.2.1
  • Siemens PP TeleControl Server Basic 64 to 256 V3.1: преди V3.1.2.1
  • Siemens PP TeleControl Server Basic 8 to 32 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic 1000 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic 256 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic 32 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic 5000 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic 64 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic 8 V3.1: преди V3.1.2.1
  • Siemens TeleControl Server Basic Serv Upgr: преди V3.1.2.1
  • Siemens TeleControl Server Basic Upgr V3.1: преди V3.1.2.1
  • siemens telecontrol_server_basic: преди 3.1.2.1

Вид слабост

История

  • 12 ноември 2024 Публикувано

Първоизточници

CVE-2024-44102: Siemens PP TeleControl Server Basic 1000 to 5000 V3.1 | freedomonline.bg