CVE-2024-47902

Published Oct 23, 2024 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Siemens

InterMesh 7177 Hybrid 2.0 Subscriber

unknown

Version	Status	Constraints
`0`	affected	< V8.2.12

Siemens

InterMesh 7707 Fire Subscriber

unknown

Version	Status	Constraints
`0`	affected	< V7.2.12

Configuration 1 [-]

AND

cpe:2.3:o:siemens:intermesh_7177_hybrid_2.0_subscriber:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:intermesh_7177_hybrid_2.0_subscriber:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:siemens:intermesh_7707_fire_subscriber_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:siemens:intermesh_7707_fire_subscriber:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-42717	A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.512% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://cert-portal.siemens.com/productcert/html/ssa-333468.html

History

Oct 30, 2024 4:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Siemens intermesh 7177 Hybrid 2.0 Subscriber Siemens intermesh 7707 Fire Subscriber Firmware
CPEs		cpe:2.3:h:siemens:intermesh_7177_hybrid_2.0_subscriber:-:::::::* cpe:2.3:h:siemens:intermesh_7707_fire_subscriber:-:::::::* cpe:2.3:o:siemens:intermesh_7177_hybrid_2.0_subscriber:::::::: cpe:2.3:o:siemens:intermesh_7707_fire_subscriber_firmware::::::::
Vendors & Products		Siemens intermesh 7177 Hybrid 2.0 Subscriber Siemens intermesh 7707 Fire Subscriber Firmware

Oct 23, 2024 7:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Siemens Siemens intermesh 7177 Hybrid2.0 Subscriber Siemens intermesh 7707 Fire Subscriber
CPEs		cpe:2.3:a:siemens:intermesh_7177_hybrid2.0_subscriber:::::::: cpe:2.3:a:siemens:intermesh_7707_fire_subscriber::::::::
Vendors & Products		Siemens Siemens intermesh 7177 Hybrid2.0 Subscriber Siemens intermesh 7707 Fire Subscriber
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Oct 23, 2024 2:30 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not authenticate GET requests that execute specific commands (such as `ping`) on operating system level.
Weaknesses		CWE-306
References		https://cert-portal.siemens.com/productcert/html/ssa-333468.html
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}` cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N'}`

Subscriptions

Siemens Intermesh 7177 Hybrid2.0 Subscriber Intermesh 7177 Hybrid 2.0 Subscriber Intermesh 7707 Fire Subscriber Intermesh 7707 Fire Subscriber Firmware

Weaknesses