Paper/Archive/CVE-2024-47902

CVE-2024-47902

Siemens InterMesh 7177 Hybrid 2.0 Subscriber — A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All…

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.7.437 × 208.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level.

Affected

ProductAffectedFixed inSource

InterMesh 7177 Hybrid 2.0 Subscriber< V8.2.12V8.2.12CNA

InterMesh 7707 Fire Subscriber< V7.2.12V7.2.12CNA

intermesh_7177_hybrid2.0_subscriber< 8.2.128.2.12CISA-ADP

intermesh_7707_fire_subscriber< 7.2.127.2.12CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

siemens (CNA)7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

siemens (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcert-portal.siemens.com/productcert/html/ssa-333468.html