Vulnerability · Published Feb 13, 2024 · Assigned by siemens
CVE-2024-23816
Critical 9.8
In plain English
A critical-severity hard-coded credentials in Location Intelligence Perpetual Large from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Official description
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | Location Intelligence Perpetual Large | 0 – before V4.3 |
| Siemens | Location Intelligence Perpetual Medium | 0 – before V4.3 |
| Siemens | Location Intelligence Perpetual Non-Prod | 0 – before V4.3 |
| Siemens | Location Intelligence Perpetual Small | 0 – before V4.3 |
| Siemens | Location Intelligence SUS Large | 0 – before V4.3 |
| Siemens | Location Intelligence SUS Medium | 0 – before V4.3 |
| Siemens | Location Intelligence SUS Non-Prod | 0 – before V4.3 |
| Siemens | Location Intelligence SUS Small | 0 – before V4.3 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C