VDB
CVE-2024-43781
CVE-2024-43781
PUBLISHED
CVSS 5.5 MEDIUM
A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Create MyConfig (CMC) <= V4.8 SP1 HF6), SINUMERIK ONE (All versions < V6.23 in connection with using Create MyConfig (CMC) <= V6.6), SINUMERIK ONE (All versions < V6.15 SP4 in connection with using Create MyConfig (CMC) <= V6.6). Affected systems, that have been provisioned with Create MyConfig (CMC), contain a Insertion of Sensitive Information into Log File vulnerability. This could allow a local authenticated user with low privileges to read sensitive information and thus circumvent access restrictions.
EPSS 0.06% · 17.8th percentile
Risk Scores
CVSS 3.1
5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
EPSS Score
0.06%
17.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINUMERIK ONE | 0, 0, 0 |
| Siemens | SINUMERIK 828D V4 | 0, 0, 0 |
| Siemens | SINUMERIK 840D sl V4 | 0, 0, 0 |
Exploit Intelligence
- CIRCL seen: CVE-2024-43781 (circl-sighting)
- https://cert-portal.siemens.com/productcert/html/ssa-097786.html (circl)
Timeline
- Sep 10, 2024 CVE Published
- Sep 10, 2024 PoC Published
- Sep 11, 2024 EPSS Score
- Oct 1, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 21, 2024 EPSS Score
- Nov 9, 2024 EPSS Score
- Nov 29, 2024 EPSS Score
- Dec 20, 2024 EPSS Score
- Jan 9, 2025 EPSS Score
- Jan 29, 2025 EPSS Score
- Feb 18, 2025 EPSS Score