Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Search

NCSC-2024-0246

Published Jun 11, 2024·Last modified Jun 11, 2024
Description
Feiten

Siemens heeft kwetsbaarheden verholpen in diverse producten, zoals SCALANCE, SICAM, Tecnomatix, SITOP en PowerSys.

Interpretaties

De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:

  • Denial-of-Service (DoS)
  • Manipulatie van gegevens
  • Omzeilen van beveiligingsmaatregel
  • (Remote) code execution (Administrator/Root rechten)
  • (Remote) code execution (Gebruikersrechten)
  • Toegang tot systeemgegevens
  • Verhoogde gebruikersrechten

De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.

Oplossingen

Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.

Kans

medium

Schade

high

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

CWE-121

Stack-based Buffer Overflow

CWE-122

Heap-based Buffer Overflow

CWE-1220

Insufficient Granularity of Access Control

CWE-123

Write-what-where Condition

CWE-125

Out-of-bounds Read

CWE-1333

Inefficient Regular Expression Complexity

CWE-170

Improper Null Termination

CWE-190

Integer Overflow or Wraparound

CWE-191

Integer Underflow (Wrap or Wraparound)

CWE-20

Improper Input Validation

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-269

Improper Privilege Management

CWE-287

Improper Authentication

CWE-295

Improper Certificate Validation

CWE-311

Missing Encryption of Sensitive Data

CWE-319

Cleartext Transmission of Sensitive Information

CWE-321

Use of Hard-coded Cryptographic Key

CWE-325

Missing Cryptographic Step

CWE-326

Inadequate Encryption Strength

CWE-328

Use of Weak Hash

CWE-330

Use of Insufficiently Random Values

CWE-349

Acceptance of Extraneous Untrusted Data With Trusted Data

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-379

Creation of Temporary File in Directory with Insecure Permissions

CWE-400

Uncontrolled Resource Consumption

CWE-401

Missing Release of Memory after Effective Lifetime

CWE-404

Improper Resource Shutdown or Release

CWE-415

Double Free

CWE-416

Use After Free

CWE-476

NULL Pointer Dereference

CWE-522

Insufficiently Protected Credentials

CWE-567

Unsynchronized Access to Shared Data in a Multithreaded Context

CWE-613

Insufficient Session Expiration

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CWE-664

Improper Control of a Resource Through its Lifetime

CWE-667

Improper Locking

CWE-704

Incorrect Type Conversion or Cast

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CWE-749

Exposed Dangerous Method or Function

CWE-754

Improper Check for Unusual or Exceptional Conditions

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CWE-787

Out-of-bounds Write

CWE-833

Deadlock

CWE-834

Excessive Iteration

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

CWE-94

Improper Control of Generation of Code ('Code Injection')

Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard