← Back

CVE-2024-47901

nvd nist
Published: Oct 23, 2024Modified: Oct 30, 2024

JSON object

Loading...
10.0
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: productcert@siemens.com (Secondary)

Description

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

Affected (2)

Siemens
2 products
Intermesh 7177 Hybrid 2.0 Subscriber
Intermesh 7707 Fire Subscriber Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Intermesh 7177 Hybrid 2.0 Subscriber
Before 8.2.12
Running on/withPlatform Versions
Siemens
Intermesh 7177 Hybrid 2.0 Subscriber
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Intermesh 7707 Fire Subscriber Firmware
Before 7.2.12
Running on/withPlatform Versions
Siemens
Intermesh 7707 Fire Subscriber
All versions

Related CWEs

CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (1)

Source: productcert@siemens.com
Vendor Advisory

Timeline

No history available yet.