Inclusion of Sensitive Information in Log Files in Siemens products - CVE-2024-43781
Published: September 11, 2024 / Updated: September 16, 2024
Vulnerability identifier: #VU97162
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-43781
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files within the Create MyConfig (CMC). A local user can read the log files and gain access to sensitive data.
Affected software
SINUMERIK 828D
SINUMERIK 840D sl
SINUMERIK ONE
SINUMERIK 840D sl
SINUMERIK ONE
How to mitigate CVE-2024-43781
Install updates from vendor's website.
SINUMERIK 828D - update to 4.95 SP3
SINUMERIK 840D sl - update to 4.95 SP3
SINUMERIK ONE - addressed in versions 6.15 SP4, 6.23
SINUMERIK 840D sl - update to 4.95 SP3
SINUMERIK ONE - addressed in versions 6.15 SP4, 6.23