Vulnerability · Published Jul 22, 2024 · Assigned by siemens
CVE-2024-37998
Critical 9.8
In plain English
A critical-severity security flaw in CPCI85 Central Processing/Communication from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). The password of administrative accounts of the affected applications can be reset without requiring the knowledge of the current password, given the auto login is enabled. This could allow an unauthorized attacker to obtain administrative access of the affected applications.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | CPCI85 Central Processing/Communication | 0 – before V5.40 |
| Siemens | SICORE Base system | 0 – before V1.4.0 |
Weakness: CWE-620 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H