ID
VAR-202408-0011
CVE
CVE-2024-38877
TITLE
Vulnerabilities in multiple Siemens products related to storing important information in plaintext
Trust: 0.8
DESCRIPTION
A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Security Server R9.2 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected devices stores initial system credentials without sufficient protection. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss allowing the attacker to laterally move within the affected network. omnivise t3000 application server , omnivise t3000 domain controller , omnivise t3000 network intrusion detection system Several Siemens products, including the above, contain vulnerabilities related to storing important information in plain text.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Omnivise T3000 is a distributed control system used primarily in fossil fuel and large renewable energy power plants
Trust: 2.16
IOT TAXONOMY
| category: | ['ICS'] | sub_category: | - | Trust: 0.6 |
AFFECTED PRODUCTS
| vendor: | siemens | model: | omnivise t3000 terminal server | scope: | lte | version: | 9.2 | Trust: 1.0 |
| vendor: | siemens | model: | omnivise t3000 thin client | scope: | gte | version: | r9.2 | Trust: 1.0 |
| vendor: | siemens | model: | omnivise t3000 product data management | scope: | gte | version: | r9.2 | Trust: 1.0 |
| vendor: | siemens | model: | omnivise t3000 network intrusion detection system | scope: | lte | version: | 9.2 | Trust: 1.0 |
| vendor: | siemens | model: | omnivise t3000 application server | scope: | gte | version: | r9.2 | Trust: 1.0 |
| vendor: | siemens | model: | omnivise t3000 domain controller | scope: | gte | version: | r9.2 | Trust: 1.0 |
| vendor: | siemens | model: | omnivise t3000 whitelisting server | scope: | gte | version: | r9.2 | Trust: 1.0 |
| vendor: | シーメンス | model: | omnivise t3000 product data management | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | omnivise t3000 network intrusion detection system | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | omnivise t3000 terminal server | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | omnivise t3000 whitelisting server | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | omnivise t3000 application server | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | omnivise t3000 thin client | scope: | - | version: | - | Trust: 0.8 |
| vendor: | シーメンス | model: | omnivise t3000 domain controller | scope: | - | version: | - | Trust: 0.8 |
| vendor: | siemens | model: | omnivise t3000 application server | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 domain controller | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 network intrusion detection system | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 product data management | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 security server | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 terminal server | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 thin client | scope: | - | version: | - | Trust: 0.6 |
| vendor: | siemens | model: | omnivise t3000 whitelisting server | scope: | - | version: | - | Trust: 0.6 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-312 | Trust: 1.0 |
| problemtype: | Plaintext storage of important information (CWE-312) [ others ] | Trust: 0.8 |
PATCH
| title: | Patch for Siemens Omnivise T3000 Application Server sensitive information plaintext storage vulnerability | url: | https://www.cnvd.org.cn/patchInfo/show/576711 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2024-38877 | Trust: 3.2 |
| db: | SIEMENS | id: | SSA-857368 | Trust: 2.4 |
| db: | JVN | id: | JVNVU99298639 | Trust: 0.8 |
| db: | JVNDB | id: | JVNDB-2024-008689 | Trust: 0.8 |
| db: | CNVD | id: | CNVD-2024-35107 | Trust: 0.6 |
REFERENCES
| url: | https://cert-portal.siemens.com/productcert/html/ssa-857368.html | Trust: 2.4 |
| url: | https://jvn.jp/vu/jvnvu99298639/ | Trust: 0.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2024-38877 | Trust: 0.8 |
SOURCES
| db: | CNVD | id: | CNVD-2024-35107 |
| db: | JVNDB | id: | JVNDB-2024-008689 |
| db: | NVD | id: | CVE-2024-38877 |
LAST UPDATE DATE
2024-09-25T22:09:05.452000+00:00
SOURCES UPDATE DATE
| db: | CNVD | id: | CNVD-2024-35107 | date: | 2024-08-12T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-008689 | date: | 2024-09-24T02:04:00 |
| db: | NVD | id: | CVE-2024-38877 | date: | 2024-09-20T23:35:04.073 |
SOURCES RELEASE DATE
| db: | CNVD | id: | CNVD-2024-35107 | date: | 2024-08-12T00:00:00 |
| db: | JVNDB | id: | JVNDB-2024-008689 | date: | 2024-09-24T00:00:00 |
| db: | NVD | id: | CVE-2024-38877 | date: | 2024-08-02T11:16:41.957 |