by Kastro
Paper/Archive/CVE-2024-47901

CVE-2024-47901

Siemens InterMesh 7177 Hybrid 2.0 Subscriber — A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All…

EPSS 1%CVSS 10.0
critical.is priorityof 100
44
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 69.4.694 × 2013.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

Affected

ProductAffectedFixed inSource
InterMesh 7177 Hybrid 2.0 Subscriber< V8.2.12V8.2.12CNA
InterMesh 7707 Fire Subscriber< V7.2.12V7.2.12CNA
intermesh_7177_hybrid2.0_subscriber< 8.2.128.2.12CISA-ADP
intermesh_7707_fire_subscriber< 7.2.127.2.12CISA-ADP

Scores by source

siemens (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
siemens (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-333468.html