CVE-2024-47903

State: Published
Severity: 6.9 Medium
Published: Oct 23, 2024
Updated: Oct 23, 2024
Reserved: Oct 4, 2024

Description

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices allows to write arbitrary files to the web server's DocumentRoot directory.

Scores

CVSS	Score	Vector	Source
4.0	6.9 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N	siemens
3.1	5.8 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N	siemens

Weaknesses

CWE-250 Execution with Unnecessary Privileges

Affected Products

Product	Versions
InterMesh 7177 Hybrid 2.0 SubscriberSiemens	before V8.2.12Affected
InterMesh 7707 Fire SubscriberSiemens	before V7.2.12Affected

References

https://cert-portal.siemens.com/productcert/html/ssa-333468.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.