CVE-2024-43781

State: Published
Severity: 6.8 Medium
Published: Sep 10, 2024
Updated: Sep 10, 2024
Reserved: Aug 16, 2024

Description

A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Create MyConfig (CMC) <= V4.8 SP1 HF6), SINUMERIK ONE (All versions < V6.23 in connection with using Create MyConfig (CMC) <= V6.6), SINUMERIK ONE (All versions < V6.15 SP4 in connection with using Create MyConfig (CMC) <= V6.6). Affected systems, that have been provisioned with Create MyConfig (CMC), contain a Insertion of Sensitive Information into Log File vulnerability. This could allow a local authenticated user with low privileges to read sensitive information and thus circumvent access restrictions.

Scores

CVSS	Score	Vector	Source
4.0	6.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	siemens
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C	siemens

Weaknesses

CWE-532 Insertion of Sensitive Information into Log File

Affected Products

Product	Versions
SINUMERIK 828D V4Siemens	before V4.95 SP3Affected
SINUMERIK 840D sl V4Siemens	before V4.95 SP3Affected
SINUMERIK ONESiemens	before V6.23Affected
SINUMERIK ONESiemens	before V6.15 SP4Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-097786.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.