Vulnerability · Published Oct 23, 2024 · Assigned by siemens
CVE-2024-47901
Critical 10.0
In plain English
A critical-severity OS command injection in InterMesh 7177 Hybrid 2.0 Subscriber from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).
Official description
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | InterMesh 7177 Hybrid 2.0 Subscriber | 0 – before V8.2.12 |
| Siemens | InterMesh 7707 Fire Subscriber | 0 – before V7.2.12 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H