Missing Immutable Root of Trust in Hardware in SIMATIC CN 4100 - CVE-2024-32742
Published: May 17, 2024
Vulnerability identifier: #VU89613
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-32742
CWE-ID: CWE-1326
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to compromise the target system.
The vulnerability exists due to the affected device contains an unrestricted USB port. An attacker with physical access can misuse the port for booting another operating system and gain complete read/write access to the filesystem.
Affected software
SIMATIC CN 4100
How to mitigate CVE-2024-32742
Install updates from vendor's website.
SIMATIC CN 4100 - update to 3.0