Vulnerability · Published Sep 10, 2024 · Assigned by siemens
CVE-2024-43781
Medium 5.5
In plain English
A medium-severity sensitive data in logs in SINUMERIK 828D V4 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Create MyConfig (CMC) <= V4.8 SP1 HF6), SINUMERIK ONE (All versions < V6.23 in connection with using Create MyConfig (CMC) <= V6.6), SINUMERIK ONE (All versions < V6.15 SP4 in connection with using Create MyConfig (CMC) <= V6.6). Affected systems, that have been provisioned with Create MyConfig (CMC), contain a Insertion of Sensitive Information into Log File vulnerability. This could allow a local authenticated user with low privileges to read sensitive information and thus circumvent access restrictions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINUMERIK 828D V4 | 0 – before V4.95 SP3 |
| Siemens | SINUMERIK 840D sl V4 | 0 – before V4.95 SP3 |
| Siemens | SINUMERIK ONE | 0 – before V6.23 |
| Siemens | SINUMERIK ONE | 0 – before V6.15 SP4 |
Weakness: CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C