Sign-up

ID

VAR-202408-0054


CVE

CVE-2024-41904


TITLE

Siemens'  sinec traffic analyzer  Vulnerability in improperly limiting excessive authentication attempts in

Trust: 0.8

sources: JVNDB: JVNDB-2024-005914

DESCRIPTION

A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V2.0). The affected application do not properly enforce restriction of excessive authentication attempts. This could allow an unauthenticated attacker to conduct brute force attacks against legitimate user credentials or keys. Siemens' sinec traffic analyzer Is vulnerable to improper restrictions on excessive authentication attempts.Information may be obtained. SINEC Traffic Analyzer is an on-premises application that monitors PNIO (PROFINET IO) communications between controllers and IO devices

Trust: 2.16

sources: NVD: CVE-2024-41904 // JVNDB: JVNDB-2024-005914 // CNVD: CNVD-2024-35433

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2024-35433

AFFECTED PRODUCTS

vendor:siemensmodel:sinec traffic analyzerscope:ltversion:2.0

Trust: 1.6

vendor:シーメンスmodel:sinec traffic analyzerscope: - version: -

Trust: 0.8

vendor:シーメンスmodel:sinec traffic analyzerscope:eqversion:2.0

Trust: 0.8

vendor:シーメンスmodel:sinec traffic analyzerscope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2024-35433 // JVNDB: JVNDB-2024-005914 // NVD: CVE-2024-41904

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2024-41904
value: HIGH

Trust: 1.0

productcert@siemens.com: CVE-2024-41904
value: HIGH

Trust: 1.0

NVD: CVE-2024-41904
value: HIGH

Trust: 0.8

CNVD: CNVD-2024-35433
value: HIGH

Trust: 0.6

CNVD: CNVD-2024-35433
severity: HIGH
baseScore: 7.8
vectorString: AV:N/AC:L/AU:N/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2024-41904
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 2.0

NVD: CVE-2024-41904
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2024-35433 // JVNDB: JVNDB-2024-005914 // NVD: CVE-2024-41904 // NVD: CVE-2024-41904

PROBLEMTYPE DATA

problemtype:CWE-307

Trust: 1.0

problemtype:Inappropriate limitation of excessive authentication attempts (CWE-307) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2024-005914 // NVD: CVE-2024-41904

PATCH

title:Patch for Siemens SINEC Traffic Analyzer Logic Flaw Vulnerability (CNVD-2024-35433)url:https://www.cnvd.org.cn/patchInfo/show/576926

Trust: 0.6

sources: CNVD: CNVD-2024-35433

EXTERNAL IDS

db:NVDid:CVE-2024-41904

Trust: 3.2

db:SIEMENSid:SSA-716317

Trust: 2.4

db:ICS CERTid:ICSA-24-228-04

Trust: 0.8

db:JVNid:JVNVU99084687

Trust: 0.8

db:JVNDBid:JVNDB-2024-005914

Trust: 0.8

db:CNVDid:CNVD-2024-35433

Trust: 0.6

sources: CNVD: CNVD-2024-35433 // JVNDB: JVNDB-2024-005914 // NVD: CVE-2024-41904

REFERENCES

url:https://cert-portal.siemens.com/productcert/html/ssa-716317.html

Trust: 2.4

url:https://jvn.jp/vu/jvnvu99084687/

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2024-41904

Trust: 0.8

url:https://www.cisa.gov/news-events/ics-advisories/icsa-24-228-04

Trust: 0.8

sources: CNVD: CNVD-2024-35433 // JVNDB: JVNDB-2024-005914 // NVD: CVE-2024-41904

SOURCES

db:CNVDid:CNVD-2024-35433
db:JVNDBid:JVNDB-2024-005914
db:NVDid:CVE-2024-41904

LAST UPDATE DATE

2024-08-24T20:29:02.779000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2024-35433date:2024-08-14T00:00:00
db:JVNDBid:JVNDB-2024-005914date:2024-08-21T02:32:00
db:NVDid:CVE-2024-41904date:2024-08-14T18:39:32.883

SOURCES RELEASE DATE

db:CNVDid:CNVD-2024-35433date:2024-08-14T00:00:00
db:JVNDBid:JVNDB-2024-005914date:2024-08-21T00:00:00
db:NVDid:CVE-2024-41904date:2024-08-13T08:15:13.003