Vulnerability · Published May 14, 2024 · Assigned by siemens
CVE-2024-33499
Critical 9.1
In plain English
A critical-severity incorrect permission assignment in SIMATIC RTLS Locating Manager from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). The affected application assigns incorrect permissions to a user management component. This could allow a privileged attacker to escalate their privileges from the Administrators group to the Systemadministrator group.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
| Siemens | SIMATIC RTLS Locating Manager | 0 – before V3.0.1.1 |
Weakness: CWE-732 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C