SecuriTricks - CVE-2024-41681

Description

A vulnerability has been identified in Location Intelligence family (All versions < V4.4). The web server of affected products is configured to support weak ciphers by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.

Product(s) Impacted

Product	Versions
Location Intelligence family	['< V4.4']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-326

Inadequate Encryption Strength

The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

References

https://cert-portal.siemens.com/productcert/html/ssa-720392.html

CVSS Score

6.7 / 10

CVSS Data - 3.1

Attack Vector: ADJACENT_NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: HIGH
Availability Impact: HIGH

CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H

View Vector String

Timeline

Published: Aug. 13, 2024, 8:15 a.m.
Last Modified: Aug. 13, 2024, 12:58 p.m.

Status : Undergoing Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

productcert@siemens.com

CVE-2024-41681