by Kastro
Paper/Archive/CVE-2024-47903

CVE-2024-47903

Siemens InterMesh 7177 Hybrid 2.0 Subscriber — A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All…

EPSS 0.4%CVSS 9.1
critical.is priorityof 100
34
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 31.1.311 × 206.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices allows to write arbitrary files to the web server's DocumentRoot directory.

Affected

ProductAffectedFixed inSource
InterMesh 7177 Hybrid 2.0 Subscriber< V8.2.12V8.2.12CNA
InterMesh 7707 Fire Subscriber< V7.2.12V7.2.12CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
siemens (CNA)6.9CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
siemens (CNA)5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refcert-portal.siemens.com/productcert/html/ssa-333468.html