Republished vendor advisory. This CISA CSAF advisory was converted from Siemens ProductCERT's CSAF advisory.
General Recommendations: As a general security measure Siemens strongly recommends to protect network access to affected products with appropriate mechanisms. It is advised to follow recommended security practices in order to run the devices in a protected IT environment.
Additional Resources: For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories
Credit: AES Corporation; Jean Pereira (CYTRES); Siemens ProductCERT
From CISA's machine-readable CSAF 2.0 advisory (JSON).
| CVE | Weakness | CVSS v3 | Details |
|---|---|---|---|
| CVE-2024-47901 | CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 10.0 Critical |
CVE-2024-47901 The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Mitigation: Disable the IP interface Vendor fix: Update to V7.2.12 or later version Vendor fix: Update to V8.2.12 or later version Affected, fixed & timelineAffected:
Workaround: Restrict access to the InterMesh network to trusted systems and persons only |
| CVE-2024-47904 | CWE-266 Incorrect Privilege Assignment | 7.8 High |
CVE-2024-47904 The affected devices contain a SUID binary that could allow an authenticated local attacker to execute arbitrary commands with root privileges. Mitigation: Disable the IP interface Vendor fix: Update to V7.2.12 or later version Vendor fix: Update to V8.2.12 or later version Affected, fixed & timelineAffected:
Workaround: Restrict access to the InterMesh network to trusted systems and persons only |
| CVE-2024-47902 | CWE-306 Missing Authentication for Critical Function | 7.2 High |
CVE-2024-47902 The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level. Mitigation: Disable the IP interface Vendor fix: Update to V7.2.12 or later version Vendor fix: Update to V8.2.12 or later version Affected, fixed & timelineAffected:
Workaround: Restrict access to the InterMesh network to trusted systems and persons only |
| CVE-2024-47903 | CWE-250 Execution with Unnecessary Privileges | 5.8 Medium |
CVE-2024-47903 The web server of affected devices allows to write arbitrary files to the web server's DocumentRoot directory. Mitigation: Disable the IP interface Vendor fix: Update to V7.2.12 or later version Vendor fix: Update to V8.2.12 or later version Affected, fixed & timelineAffected:
Workaround: Restrict access to the InterMesh network to trusted systems and persons only |
Scores and weakness types are as CISA or the republishing vendor stated them in this advisory; the linked CVE pages carry the independently enriched CVSS and SSVC assessments.
No coverage found in monitored research blogs or news feeds.
| CVE | CVSS | Affected |
|---|---|---|
| CVE-2024-47901 | 10.0 Critical | Siemens InterMesh 7177 Hybrid 2.0 Subscriber A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < … |
| CVE-2024-47904 | 7.8 High | Siemens InterMesh 7177 Hybrid 2.0 Subscriber A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < … |
| CVE-2024-47902 | 7.2 High | Siemens InterMesh 7177 Hybrid 2.0 Subscriber A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < … |
| CVE-2024-47903 | 5.8 Medium | Siemens InterMesh 7177 Hybrid 2.0 Subscriber A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < … |
Named by the advisory itself. Each CVE links to its tracked detail page.
Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.