CVE-2024-37990 — Vulnetix

CVE-2024-37990 PUBLISHED CVSS 6.5 MEDIUM

A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected applications contain configuration files which can be modified. An attacker with privilege access can modify these files and enable features that are not released for this device.

EPSS 0.22% · 44.5th percentile

Risk Scores

CVSS 3.1

6.5

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

EPSS Score

0.22%

44.5th percentile

Affected Products

Vendor	Product	Versions
siemens	simatic_reader_rf685r_arib_firmware	0
siemens	simatic_rf1140r_firmware	0
siemens	simatic_reader_rf685r_cmiit_firmware	0
Siemens	SIMATIC RF186C	0
Siemens	SIMATIC Reader RF680R ETSI	0
Siemens	SIMATIC Reader RF615R CMIIT	0
siemens	simatic_reader_rf650r_arib_firmware	0
siemens	simatic_reader_rf615r_etsi_firmware	0
siemens	simatic_rf1170r_firmware	0
Siemens	SIMATIC RF186CI	0
Siemens	SIMATIC RF188CI	0
Siemens	SIMATIC Reader RF685R ARIB	0
Siemens	SIMATIC RF166C	0
siemens	simatic_rf186ci_firmware	0
siemens	simatic_reader_rf650r_cmiit_firmware	0
siemens	simatic_rf188c_firmware	0
Siemens	SIMATIC Reader RF610R ETSI	0
Siemens	SIMATIC Reader RF680R FCC	0
Siemens	SIMATIC Reader RF615R ETSI	0
Siemens	SIMATIC Reader RF650R ETSI	0

…and 34 more

Exploit Intelligence

CIRCL seen: CVE-2024-37990 (circl-sighting)
https://cert-portal.siemens.com/productcert/html/ssa-765405.html (circl)

Timeline

Sep 10, 2024 CVE Published
Sep 10, 2024 PoC Published
Sep 11, 2024 EPSS Score
Sep 18, 2024 CVE Updated
Oct 1, 2024 EPSS Score
Oct 4, 2024 Coalition ESS Score
Oct 21, 2024 EPSS Score
Nov 9, 2024 EPSS Score
Nov 29, 2024 EPSS Score
Dec 20, 2024 EPSS Score
Jan 9, 2025 EPSS Score
Jan 29, 2025 EPSS Score

References

Open in Interactive Console →