Details of VAR-202405-0155

ID

VAR-202405-0155

CVE

CVE-2024-30209

TITLE

Siemens SIMATIC RTLS Locating Manager sensitive information plaintext transmission vulnerability

Trust: 0.6

sources: CNVD: CNVD-2024-23116

DESCRIPTION

A vulnerability has been identified in SIMATIC RTLS Locating Manager (6GT2780-0DA00) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-0DA30) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA10) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA20) (All versions < V3.0.1.1), SIMATIC RTLS Locating Manager (6GT2780-1EA30) (All versions < V3.0.1.1). Affected systems transmit client-side resources without proper cryptographic protection. This could allow an attacker to eavesdrop on and modify resources in transit. A successful exploit requires an attacker to be in the network path between the RTLS Locating Manager server and a client (MitM). SIMATIC RTLS Locating Manager is used to configure, operate, and maintain SIMATIC RTLS devices, which are real-time wireless location systems that provide location solutions. Siemens SIMATIC RTLS Locating Manager has a sensitive information plaintext transmission vulnerability

Trust: 1.44

sources: NVD: CVE-2024-30209 // CNVD: CNVD-2024-23116

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2024-23116

AFFECTED PRODUCTS

vendor:

siemens

model:

simatic rtls locating manager

scope:

version:

v3.0.1.1

Trust: 4.2

sources: CNVD: CNVD-2024-23116

CVSS

SEVERITY

CVSSV2

CVSSV3

productcert@siemens.com:	CVE-2024-30209
value:	CRITICAL
Trust: 1.0
CNVD:	CNVD-2024-23116
value:	HIGH
Trust: 0.6

CNVD:	CNVD-2024-23116
severity:	HIGH
baseScore:	8.3
vectorString:	AV:A/AC:L/AU:N/C:C/I:C/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	6.5
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

productcert@siemens.com:	CVE-2024-30209
baseSeverity:	CRITICAL
baseScore:	9.6
vectorString:	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	2.8
impactScore:	6.0
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2024-23116 // NVD: CVE-2024-30209

PROBLEMTYPE DATA

problemtype:

CWE-319

Trust: 1.0

sources: NVD: CVE-2024-30209

PATCH

title:

Patch for Siemens SIMATIC RTLS Locating Manager sensitive information plaintext transmission vulnerability

url:

https://www.cnvd.org.cn/patchInfo/show/546776

Trust: 0.6

sources: CNVD: CNVD-2024-23116

EXTERNAL IDS

db:	SIEMENS	id:	SSA-093430	Trust: 1.6
db:	NVD	id:	CVE-2024-30209	Trust: 1.6
db:	CNVD	id:	CNVD-2024-23116	Trust: 0.6

sources: CNVD: CNVD-2024-23116 // NVD: CVE-2024-30209

REFERENCES

url:

https://cert-portal.siemens.com/productcert/html/ssa-093430.html

Trust: 1.6

sources: CNVD: CNVD-2024-23116 // NVD: CVE-2024-30209

SOURCES

db:	CNVD	id:	CNVD-2024-23116
db:	NVD	id:	CVE-2024-30209

LAST UPDATE DATE

2024-08-14T13:41:07.052000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2024-23116	date:	2024-05-17T00:00:00
db:	NVD	id:	CVE-2024-30209	date:	2024-06-11T12:15:14.740

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2024-23116	date:	2024-05-17T00:00:00
db:	NVD	id:	CVE-2024-30209	date:	2024-05-14T16:16:49.580