Use of Hard-coded Password in SIMATIC CN 4100 - CVE-2024-32741
Published: May 17, 2024
Vulnerability identifier: #VU89612
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-32741
CWE-ID: CWE-259
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected device contains hard coded password which is used for the privileged system user root and for the boot loader GRUB by default. A remote attacker can gain root access to the target device.
Affected software
SIMATIC CN 4100
How to mitigate CVE-2024-32741
Install updates from vendor's website.
SIMATIC CN 4100 - update to 3.0