CNVD-2024-38017
Record from circl · Published September 9, 2024
SIMATIC CP 1242和CP 1243相关处理器将SIMATIC S7-1200控制器连接到广域网（WAN）。它们提供集成的安全功能，如防火墙、虚拟专用网络（VPN）和支持其他数据加密协议。SIMATIC HMI Panels用于操作员控制和监控机器和设备。SIMATIC IPC DiagBase diagnostics software允许及早识别SIMATIC工控机上的任何潜在故障，并有助于避免或减少系统停机时间。SIMATIC IPC DiagMonitor监控、报告、可视化和记录SIMATIC IPCs的系统状态。它与其他系统通信，并在事件发生时做出反应。Communication processor (CP) modules SIMATIC TIM 3V-IE和TIM 4R-IE设计使SIMATIC S7-300/S7-400 CPU能够进行以太网或遥控通信。SIMATIC WinCC Runtime Advanced是一个可视化运行时平台，用于操作员控制和监控机器和工厂。SIPLUS extreme产品专为在极端条件下可靠运行而设计，基于SIMATIC, LOGO!, SITOP, SINAMICS, SIMOTION, SCALANCE或其他设备。SIPLUS设备使用与其所基于的产品相同的固件。 Siemens Industrial产品存在空指针解引用漏洞，该漏洞源于受影响设备的 Web 服务器无法正确处理某些请求，导致监视器超时，从而可能导致指针被清理。攻击者可利用该漏洞在系统中造成拒绝服务。
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| SIMATIC CP 1243-7 LTE | Siemens | V3.5.20 |
| SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) | Siemens | 3.5.20 |
| SIMATIC CP 1243-8 IRC | Siemens | V3.5.20 |
| SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) | Siemens | V3.5.20 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SIMATIC CP 1243-7 LTE | 0 |
| Siemens | SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) | 0 |
| Siemens | SIMATIC IPC DiagBase | 0 |
| Siemens | SIMATIC CP 1243-8 IRC | 0 |
| Siemens | SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) | 0 |
| Siemens | SIMATIC IPC DiagMonitor | All versions |
| Siemens | SIMATIC CP 1243-1 (incl. SIPLUS variants) | 0 |
| Siemens | SIPLUS TIM 1531 IRC | 0 |
| Siemens | SIMATIC WinCC Runtime Advanced | All versions |
| Siemens | TIM 1531 IRC | 0 |
| Siemens | SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) | 0 |
| Siemens | SIMATIC HMI Comfort Panels (incl. SIPLUS variants) | * |
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CNVD-2024-38017
vulnetix vdb fixes CNVD-2024-38017Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CNVD-2024-38017/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart