CVE-2024-23816 - Vulnerability Details - OpenCVE

A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Siemens	Location Intelligence

Configuration 1 [-]

cpe:2.3:a:siemens:location_intelligence:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-580228.html

History

Tue, 22 Oct 2024 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Siemens Siemens location Intelligence
CPEs		cpe:2.3:a:siemens:location_intelligence::::::::
Vendors & Products		Siemens Siemens location Intelligence

MITRE

Status: PUBLISHED

Assigner: siemens

Published: 2024-02-13T09:00:27.125Z

Updated: 2024-08-01T23:13:08.454Z

Reserved: 2024-01-22T17:44:56.763Z

Link: CVE-2024-23816

Vulnrichment

No data.

NVD

Status : Modified

Published: 2024-02-13T09:15:50.343

Modified: 2024-11-21T08:58:28.797

Link: CVE-2024-23816

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-23816", "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "state": "PUBLISHED", "assignerShortName": "siemens", "dateReserved": "2024-01-22T17:44:56.763Z", "datePublished": "2024-02-13T09:00:27.125Z", "dateUpdated": "2024-08-01T23:13:08.454Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77", "shortName": "siemens", "dateUpdated": "2024-02-13T09:00:27.125Z"}, "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application."}], "affected": [{"vendor": "Siemens", "product": "Location Intelligence Perpetual Large", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence Perpetual Medium", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence Perpetual Non-Prod", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence Perpetual Small", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence SUS Large", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence SUS Medium", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence SUS Non-Prod", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "Location Intelligence SUS Small", "versions": [{"status": "affected", "version": "0", "lessThan": "V4.3", "versionType": "custom"}], "defaultStatus": "unknown"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials", "type": "CWE"}]}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:13:08.454Z"}, "title": "CVE Program Container", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:location_intelligence:*:*:*:*:*:*:*:*", "matchCriteriaId": "30C51EBA-660C-4920-89FB-5A72F545E737", "versionEndExcluding": "4.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application."}, {"lang": "es", "value": "Se ha identificado una vulnerabilidad en: \nLocation Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (Todas las versiones < V4.3), \nLocation Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (Todas las versiones < V4.3), \nLocation Intelligence Perpetual Non -Prod (9DE5110-8CA10-1AX0) (todas las versiones < V4.3), \nLocation Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (todas las versiones < V4.3), \nLocation Intelligence SUS Large (9DE5110-8CA13-1BX0) ( Todas las versiones < V4.3), \nLocation Intelligence SUS Medium (9DE5110-8CA12-1BX0) (Todas las versiones < V4.3), \nLocation Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (Todas las versiones < V4.3), \nLocation Intelligence SUS Small (9DE5110-8CA11-1BX0) (Todas las versiones < V4.3). \nLos productos afectados utilizan un valor secreto codificado para el c\u00e1lculo de un c\u00f3digo de autenticaci\u00f3n de mensaje hash con clave. Esto podr\u00eda permitir que un atacante remoto no autenticado obtenga acceso administrativo completo a la aplicaci\u00f3n."}], "id": "CVE-2024-23816", "lastModified": "2024-11-21T08:58:28.797", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "productcert@siemens.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-13T09:15:50.343", "references": [{"source": "productcert@siemens.com", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html"}], "sourceIdentifier": "productcert@siemens.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "productcert@siemens.com", "type": "Secondary"}]}