CVE-2024-31484

Description

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Reserved 2024-04-04 | Published 2024-05-14 | Updated 2025-02-13 | Assigner siemens

Problem types

CWE-170: Improper Null Termination

Product status

Default status
unknown

Any version before V16.41
affected

Default status
unknown

Any version before V5.30
affected

Default status
unknown

Any version before V06.02
affected

Default status
unknown

Any version before V10.46
affected

Default status
unknown

Any version before V03.27
affected

Default status
unknown

Any version before V06.05
affected

References

cert-portal.siemens.com/productcert/html/ssa-871704.html

cert-portal.siemens.com/productcert/html/ssa-620338.html

seclists.org/fulldisclosure/2024/Jul/4

cve.org (CVE-2024-31484)

nvd.nist.gov (CVE-2024-31484)

Download JSON