The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.
History

Tue, 08 Apr 2025 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862

Mon, 27 Jan 2025 18:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


Tue, 08 Oct 2024 08:45:00 +0000

Type Values Removed Values Added
Description The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.
Weaknesses CWE-288
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2025-04-08T20:41:06.295Z

Reserved: 2024-09-12T07:44:52.468Z

Link: CVE-2024-46887

cve-icon Vulnrichment

Updated: 2025-01-27T17:57:07.793Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-10-08T09:15:16.447

Modified: 2025-04-08T21:15:46.690

Link: CVE-2024-46887

cve-icon Redhat

No data.