by Kastro
Paper/Archive/CVE-2024-38879

CVE-2024-38879

Siemens Omnivise T3000 Application Server R9.2 — A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omn…

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.6.556 × 2011.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions). The affected system exposes the port of an internal application on the public network interface allowing an attacker to circumvent authentication and directly access the exposed application.

Affected

ProductAffectedFixed inSource
Omnivise T3000 Application Server R9.2all versions–CNA
Omnivise T3000 R8.2 SP3all versions–CNA
Omnivise T3000 R8.2 SP4all versions–CNA
omnivise_t3000_application_serverr9.2 – *–CISA-ADP
omnivise_t3000r8.2_sp3 – *–CISA-ADP
omnivise_t3000r8.2_sp4 – *–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
siemens (CNA)8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
siemens (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refcert-portal.siemens.com/productcert/html/ssa-857368.htmlrefseclists.org/fulldisclosure/2024/Nov/5