Vulnerability · Published Oct 23, 2024 · Assigned by siemens
CVE-2024-47902
High 7.2
In plain English
A high-severity missing authentication in InterMesh 7177 Hybrid 2.0 Subscriber from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | InterMesh 7177 Hybrid 2.0 Subscriber | 0 – before V8.2.12 |
| Siemens | InterMesh 7707 Fire Subscriber | 0 – before V7.2.12 |
Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N