CVE-2024-38877

Aug. 2, 2024, 12:59 p.m.

8.2
High

Description

A vulnerability has been identified in Omnivise T3000 Application Server (All versions), Omnivise T3000 Domain Controller (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) (All versions), Omnivise T3000 Product Data Management (PDM) (All versions), Omnivise T3000 Security Server (All versions), Omnivise T3000 Terminal Server (All versions), Omnivise T3000 Thin Client (All versions), Omnivise T3000 Whitelisting Server (All versions). The affected devices stores initial system credentials without sufficient protection. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss allowing the attacker to laterally move within the affected network.

Product(s) Impacted

Product Versions
Omnivise T3000 Application Server
  • All versions
Omnivise T3000 Domain Controller
  • All versions
Omnivise T3000 Network Intrusion Detection System (NIDS)
  • All versions
Omnivise T3000 Product Data Management (PDM)
  • All versions
Omnivise T3000 Security Server
  • All versions
Omnivise T3000 Terminal Server
  • All versions
Omnivise T3000 Thin Client
  • All versions
Omnivise T3000 Whitelisting Server
  • All versions

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-312
Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

References

https://cert-portal.siemens.com/productcert/html/ssa-857368.html

Tags

CWE-312
productcert@siemens.com
2024-08-02
CVE-2024-38877

CVSS Score

8.2 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: Aug. 2, 2024, 11:16 a.m.
Last Modified: Aug. 2, 2024, 12:59 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

productcert@siemens.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.