CVE-2024-23816 (GCVE-0-2024-23816)
Vulnerability from cvelistv5 – Published: 2024-02-13 09:00 – Updated: 2025-05-09 18:28
VLAI?
Summary
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.
Severity ?
9.8 (Critical)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Siemens | Location Intelligence Perpetual Large |
Affected:
0 , < V4.3
(custom)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T23:13:08.454Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-23816",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-05-08T18:42:02.272695Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-05-09T18:28:24.829Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Location Intelligence Perpetual Large",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence Perpetual Medium",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence Perpetual Non-Prod",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence Perpetual Small",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence SUS Large",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence SUS Medium",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence SUS Non-Prod",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unknown",
"product": "Location Intelligence SUS Small",
"vendor": "Siemens",
"versions": [
{
"lessThan": "V4.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions \u003c V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions \u003c V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions \u003c V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions \u003c V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions \u003c V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions \u003c V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions \u003c V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions \u003c V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-13T09:00:27.125Z",
"orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"shortName": "siemens"
},
"references": [
{
"url": "https://cert-portal.siemens.com/productcert/html/ssa-580228.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
"assignerShortName": "siemens",
"cveId": "CVE-2024-23816",
"datePublished": "2024-02-13T09:00:27.125Z",
"dateReserved": "2024-01-22T17:44:56.763Z",
"dateUpdated": "2025-05-09T18:28:24.829Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-580228.html\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-01T23:13:08.454Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-23816\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-08T18:42:02.272695Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-08T18:42:04.074Z\"}}], \"cna\": {\"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C\"}}], \"affected\": [{\"vendor\": \"Siemens\", \"product\": \"Location Intelligence Perpetual Large\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence Perpetual Medium\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence Perpetual Non-Prod\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence Perpetual Small\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence SUS Large\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence SUS Medium\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence SUS Non-Prod\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}, {\"vendor\": \"Siemens\", \"product\": \"Location Intelligence SUS Small\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"V4.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"references\": [{\"url\": \"https://cert-portal.siemens.com/productcert/html/ssa-580228.html\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions \u003c V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions \u003c V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions \u003c V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions \u003c V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions \u003c V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions \u003c V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions \u003c V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions \u003c V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-798\", \"description\": \"CWE-798: Use of Hard-coded Credentials\"}]}], \"providerMetadata\": {\"orgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"shortName\": \"siemens\", \"dateUpdated\": \"2024-02-13T09:00:27.125Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-23816\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-09T18:28:24.829Z\", \"dateReserved\": \"2024-01-22T17:44:56.763Z\", \"assignerOrgId\": \"cec7a2ec-15b4-4faf-bd53-b40f371f3a77\", \"datePublished\": \"2024-02-13T09:00:27.125Z\", \"assignerShortName\": \"siemens\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…