Severity
Medium
Analysis Summary
CVE-2024-41683 CVSS:5.3
Siemens Location Intelligence could allow a remote attacker to obtain sensitive information, caused by the failure to properly enforce a strong user password policy. An attacker could exploit this vulnerability to facilitate a brute force attack against legitimate user passwords.
CVE-2024-41938 CVSS:5.5
Siemens SINEC NMS contains a path traversal vulnerability. By sending a specially crafted request to the importCertificate function, a remote authenticated attacker could exploit this vulnerability to delete arbitrary certificate files on the drive SINEC NMS is installed on.
CVE-2024-41905 CVSS:6.8
Siemens SINEC Traffic Analyzer could allow a remote authenticated attacker to obtain sensitive information. The affected application does not have access control for accessing the files. An attacker could exploit this vulnerability to get access to sensitive information.
CVE-2024-41941 CVSS:4.3
Siemens SINEC NMS could allow a remote authenticated attacker to bypass security restrictions, caused by the failure to properly enforce authorization checks. An attacker could exploit this vulnerability to bypass the checks and modify settings in the application without authorization.
Impact
- Information Disclosure
Indicators of Compromise
CVE
- CVE-2024-41683
- CVE-2024-41938
- CVE-2024-41905
- CVE-2024-41941
Affected Vendors
Affected Products
- Siemens SINEC NMS - 2.0
- Siemens Location Intelligence family - 4.0
- Siemens SINEC NMS - 2.0 Siemens SINEC Traffic Analyzer - 1.0
Remediation
Refer to Siemens Security Advisory Advisory for patch, upgrade or suggested workaround information.