VDB
ICSA-24-193-08
ICSA-24-193-08
PUBLISHED
CVSS 7.5 HIGH
The Mendix Encryption module versions V10.0.0 and V10.0.1 define a specific hard-coded default value for the EncryptionKey constant, which is used in projects where no individual EncryptionKey was specified. This could allow to an attacker to decrypt any encrypted project data, as the default encryption key can be considered compromised. Siemens has released a new version for Mendix Encryption and recommends to update to the latest version.
Risk Scores
CVSS v3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mendix Encryption |
Timeline
- Jul 9, 2024 CVE Published
References
- https://cert-portal.siemens.com/productcert/csaf/ssa-998949.json advisory
- https://cert-portal.siemens.com/productcert/html/ssa-998949.html advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-998949.pdf advisory
- https://cert-portal.siemens.com/productcert/txt/ssa-998949.txt advisory
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-193-08.json advisory
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-08 advisory
- https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01 url
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices url
- https://www.cisa.gov/topics/industrial-control-systems url
- https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf url
- https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf url
- https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B url