Siemens SINEC Security Monitor Multiple Vulnerabilities (RCE/LPE/SSRF) CVE-2024-47553/47562/47563/47565

Key Information Vulnerability Description Vulnerability ID: SSA-430425 Affected Product: SINEC Security Monitor before V4.9.0 Affected Versions: All versions < V4.9.0 Vulnerability Type: Multiple vulnerabilities CVSS v3.1 Base Score: 9.9 CVSS v4.0 Base Score: 9.4 Vulnerability Impact Description: Multiple vulnerabilities, including but not limited to: - CVE-2024-47553: Improper validation of user input to the command, allowing a remote attacker with low privileges to execute arbitrary code. - CVE-2024-47562: Improper handling of special elements in user input to the command, allowing a local attacker with low privileges to execute privileged commands. - CVE-2024-47563: Improper validation of file paths, allowing an unauthorized remote attacker to create files in writable directories. - CVE-2024-47565: Improper validation of user input against an allowed values list, allowing a remote attacker with low privileges to tamper with the configuration of the affected application. Solution Recommendation: Upgrade to V4.9.0 or later. Link: Upgrade to V4.9.0 or later Additional Information Release Date: 2024-10-08 Update Date: 2024-10-08 Current Version: V1.0 Affected Products and Versions: All versions < V4.9.0 Affected Components: All CVEs Exploitation and Mitigation: Refer to the affected products and solution sections. General Security Recommendations: Configure the environment in accordance with industrial security guidelines and follow recommendations in the product manual. Product Description: SINEC Security Monitor is software used for monitoring and managing industrial network security. Vulnerability Description: Detailed description of the nature and impact of each vulnerability. Additional Information: Contact information for Siemens ProductCERT is provided. Historical Data: Updated on V1.0 (2024-10-08). Terms of Use: Siemens Security Advisories are subject to their terms of use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SINEC Security Monitor Multiple Vulnerabilities (RCE/LPE/SSRF) CVE-2024-47553/47562/47563/47565