Improper Check or Handling of Exceptional Conditions in Siemens products - CVE-2024-37995

Vulnerability identifier: #VU97160

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-37995

CWE-ID: CWE-703

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to the affected application improperly handles error while a faulty certificate upload leading to crashing of application. A remote administrator can disclose sensitive information.

SIMATIC RF1170R
SIMATIC RF1140R
SIMATIC RF360R
SIMATIC Reader RF680R ARIB
SIMATIC Reader RF685R FCC
SIMATIC Reader RF685R ETSI
SIMATIC Reader RF685R CMIIT
SIMATIC Reader RF685R ARIB
SIMATIC Reader RF680R FCC
SIMATIC Reader RF680R ETSI
SIMATIC Reader RF680R CMIIT
SIMATIC Reader RF650R FCC
SIMATIC Reader RF650R ETSI
SIMATIC Reader RF650R CMIIT
SIMATIC Reader RF650R ARIB
SIMATIC Reader RF615R FCC
SIMATIC Reader RF615R ETSI
SIMATIC Reader RF615R CMIIT
SIMATIC Reader RF610R FCC
SIMATIC Reader RF610R ETSI
SIMATIC Reader RF610R CMIIT
SIMATIC RF185C
SIMATIC RF188CI
SIMATIC RF186C
SIMATIC RF186CI
SIMATIC RF188C
SIMATIC RF166C

Install updates from vendor's website.

SIMATIC RF1170R - update to 1.1
SIMATIC RF1140R - update to 1.1
SIMATIC RF185C - update to 2.2
SIMATIC RF360R - update to 2.2
SIMATIC RF188CI - update to 2.2
SIMATIC RF166C - update to 2.2
SIMATIC RF186C - update to 2.2
SIMATIC RF186CI - update to 2.2
SIMATIC RF188C - update to 2.2
SIMATIC Reader RF680R ARIB - update to 4.2
SIMATIC Reader RF685R FCC - update to 4.2
SIMATIC Reader RF685R ETSI - update to 4.2
SIMATIC Reader RF685R CMIIT - update to 4.2
SIMATIC Reader RF685R ARIB - update to 4.2
SIMATIC Reader RF680R FCC - update to 4.2
SIMATIC Reader RF680R ETSI - update to 4.2
SIMATIC Reader RF680R CMIIT - update to 4.2
SIMATIC Reader RF650R FCC - update to 4.2
SIMATIC Reader RF650R ETSI - update to 4.2
SIMATIC Reader RF650R CMIIT - update to 4.2
SIMATIC Reader RF650R ARIB - update to 4.2
SIMATIC Reader RF615R FCC - update to 4.2
SIMATIC Reader RF615R ETSI - update to 4.2
SIMATIC Reader RF615R CMIIT - update to 4.2
SIMATIC Reader RF610R FCC - update to 4.2
SIMATIC Reader RF610R ETSI - update to 4.2
SIMATIC Reader RF610R CMIIT - update to 4.2

• https://cert-portal.siemens.com/productcert/html/ssa-765405.html

• Multiple vulnerabilities in Siemens SIMATIC RFID Readers