Vulnerability-Lookup

GHSA-42VC-VFQH-CR2X

Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2024-11-27 21:32

Details

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30). The affected device firmwares contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.3 (High)


                  
                    CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-31484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-170"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T16:16:50Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in CPC80 Central Processing/Communication (All versions \u003c V16.41), CPCI85 Central Processing/Communication (All versions \u003c V5.30). The affected device firmwares contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
  "id": "GHSA-42vc-vfqh-cr2x",
  "modified": "2024-11-27T21:32:43Z",
  "published": "2024-05-14T18:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31484"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/4"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Nov/18"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2024-31484 (GCVE-0-2024-31484)

Vulnerability from cvelistv5 – Published: 2024-05-14 10:02 – Updated: 2025-02-13 17:47

Summary

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

7.3 (High)


                        
                          CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-28 19:54 UTC

CWE

CWE-170 - Improper Null Termination

Assigner

siemens icscert root Scorecard

References

4 references

URL	Tags
https://cert-portal.siemens.com/productcert/html/…
https://cert-portal.siemens.com/productcert/html/…
http://seclists.org/fulldisclosure/2024/Jul/4
http://seclists.org/fulldisclosure/2024/Nov/18

Impacted products

8 products

Vendor	Product	Version
Siemens	CPC80 Central Processing/Communication	Affected: 0 , < V16.41 (custom)
Siemens	CPCI85 Central Processing/Communication	Affected: 0 , < V5.30 (custom)
Siemens	CPCX26 Central Processing/Communication	Affected: 0 , < V06.02 (custom)
Siemens	ETA4 Ethernet Interface IEC60870-5-104	Affected: 0 , < V10.46 (custom)
Siemens	ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2	Affected: 0 , < V03.27 (custom)
Siemens	PCCX26 Ax 1703 PE, Contr, Communication Element	Affected: 0 , < V06.05 (custom)
siemens	cpc80_central_processing\/communication	Affected: 0 , < 16.41 (custom) cpe:2.3:a:siemens:cpc80_central_processing\/communication:16.41:::::::*
siemens	cpci85_central_processing\/communication	Affected: 0 , < 5.30 (custom) cpe:2.3:a:siemens:cpci85_central_processing\/communication:5.30:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:siemens:cpc80_central_processing\\/communication:16.41:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cpc80_central_processing\\/communication",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "16.41",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:siemens:cpci85_central_processing\\/communication:5.30:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "cpci85_central_processing\\/communication",
            "vendor": "siemens",
            "versions": [
              {
                "lessThan": "5.30",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-31484",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-28T19:54:51.490746Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:36:20.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-11-27T21:02:39.703Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2024/Jul/4"
          },
          {
            "url": "http://seclists.org/fulldisclosure/2024/Nov/18"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "CPC80 Central Processing/Communication",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V16.41",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "CPCI85 Central Processing/Communication",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V5.30",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "CPCX26 Central Processing/Communication",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V06.02",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "ETA4 Ethernet Interface IEC60870-5-104",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V10.46",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V03.27",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "product": "PCCX26 Ax 1703 PE, Contr, Communication Element",
          "vendor": "Siemens",
          "versions": [
            {
              "lessThan": "V06.05",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability has been identified in CPC80 Central Processing/Communication (All versions \u003c V16.41), CPCI85 Central Processing/Communication (All versions \u003c V5.30), CPCX26 Central Processing/Communication (All versions \u003c V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions \u003c V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions \u003c V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions \u003c V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        {
          "cvssV4_0": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-170",
              "description": "CWE-170: Improper Null Termination",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-07-04T06:06:04.302Z",
        "orgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
        "shortName": "siemens"
      },
      "references": [
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
        },
        {
          "url": "http://seclists.org/fulldisclosure/2024/Jul/4"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "cec7a2ec-15b4-4faf-bd53-b40f371f3a77",
    "assignerShortName": "siemens",
    "cveId": "CVE-2024-31484",
    "datePublished": "2024-05-14T10:02:23.871Z",
    "dateReserved": "2024-04-04T11:43:06.066Z",
    "dateUpdated": "2025-02-13T17:47:58.073Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-42VC-VFQH-CR2X

CVE-2024-31484 (GCVE-0-2024-31484)

Tags

Sightings

Nomenclature

Related by attack behaviour