Siemens SINEC Traffic Analyzer Security Advisory: Multiple Vulnerabilities (CVE-2024-24809, CVE-2025-40766-70)

Key Information Vulnerability Overview Vulnerability ID: SSA-517338 Affected Product: SINEC Traffic Analyzer Affected Versions: Versions prior to V3.0 CVSS v3.1 Base Score: 7.8 CVSS v4.0 Base Score: 8.8 Affected Products and Versions Affected Products and Versions: SINEC Traffic Analyzer (KGS96822-USG01-USG01) Remediation: Upgrade to the latest version Vulnerability Descriptions 1. CVE-2024-24809 - Description: When NGINX Plus or NGINX OSS is configured to use the HTTP/3 QUIC module, undisclosed requests may cause NGINX worker processes to terminate. - CVSS v3.1 Base Score: 7.5 - CVSS v4.0 Base Score: 7.5 2. CVE-2024-24990 - Description: When NGINX Plus or NGINX OSS is configured to use the HTTP/3 QUIC module, undisclosed requests may cause NGINX worker processes to terminate. - CVSS v3.1 Base Score: 7.5 - CVSS v4.0 Base Score: 7.5 3. CVE-2025-40766 - Description: The affected application runs Docker containers without sufficient resource and security restrictions, allowing attackers to perform denial-of-service (DoS) attacks. - CVSS v3.1 Base Score: 6.8 - CVSS v4.0 Base Score: 6.8 4. CVE-2025-40767 - Description: The affected application runs Docker containers without adequate security controls to enforce isolation, allowing attackers to gain elevated access and potentially access sensitive host resources. - CVSS v3.1 Base Score: 7.8 - CVSS v4.0 Base Score: 7.8 5. CVE-2025-40768 - Description: The affected application exposes an internal service port that is accessible from external networks. This may allow unauthorized attackers to access the application. - CVSS v3.1 Base Score: 7.3 - CVSS v4.0 Base Score: 7.3 6. CVE-2025-40769 - Description: The affected application uses a Content Security Policy that permits insecure script execution methods. This may allow attackers to execute unauthorized scripts, potentially leading to cross-site scripting (XSS) attacks. - CVSS v3.1 Base Score: 7.4 - CVSS v4.0 Base Score: 7.5 7. CVE-2025-40770 - Description: The affected application uses a monitoring interface that does not operate in silent passive mode. This may allow attackers to interact with the interface, potentially leading to man-in-the-middle (MITM) attacks. - CVSS v3.1 Base Score: 7.4 - CVSS v4.0 Base Score: 7.4

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SINEC Traffic Analyzer Security Advisory: Multiple Vulnerabilities (CVE-2024-24809, CVE-2025-40766-70)