Siemens CPCI85 Central Processing/Communication
At a glance
- Source
- NVD
- EPSS
- EPSS 2.44 % · percentile 84 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- siemens
- NVD status
- Deferred
Description
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.30), SICORE Base system (All versions < V1.3.0). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.
Weaknesses (CWE)
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | siemens |
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | siemens |
| CVSS 4.0 | HIGH 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · productcert@siemens.com (Secondary) |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · productcert@siemens.com (Secondary) |
European references
- ENISA EUVD · EUVD-2024-29365
- GCVE · GCVE-0-2024-31485
CERT-FR advisories
- CERTFR-2024-AVI-0393 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Siemens · CPCI85 Central Processing/Communication | affected 0 < V5.30 |
| Siemens · SICORE Base system | affected 0 < V1.3.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |