Riskcovery

CVE-2024-53649

State
Published
Severity
7.1 High
Published
Jan 14, 2025
Updated
Nov 11, 2025
Reserved
Nov 21, 2024

Read the record on cve.org

Description

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V9.80), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6MD86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 6MD89 (CP300) (All versions >= V7.80 < V9.68), SIPROTEC 5 6MU85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7KE85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SA82 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7SA82 (CP150) (All versions < V9.80), SIPROTEC 5 7SA86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SA87 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SD82 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7SD82 (CP150) (All versions < V9.80), SIPROTEC 5 7SD86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SD87 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SJ81 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7SJ81 (CP150) (All versions < V9.80), SIPROTEC 5 7SJ82 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7SJ82 (CP150) (All versions < V9.80), SIPROTEC 5 7SJ85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SJ86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SK82 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7SK82 (CP150) (All versions < V9.80), SIPROTEC 5 7SK85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SL82 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7SL82 (CP150) (All versions < V9.80), SIPROTEC 5 7SL86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SL87 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7SS85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7ST85 (CP300) (All versions < V9.68), SIPROTEC 5 7ST86 (CP300) (All versions < V9.80), SIPROTEC 5 7SX82 (CP150) (All versions < V9.80), SIPROTEC 5 7SX85 (CP300) (All versions < V9.80), SIPROTEC 5 7SY82 (CP150) (All versions < V9.80), SIPROTEC 5 7UM85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7UT82 (CP100) (All versions >= V7.80 < V8.90), SIPROTEC 5 7UT82 (CP150) (All versions < V9.80), SIPROTEC 5 7UT85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7UT86 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7UT87 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7VE85 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7VK87 (CP300) (All versions >= V7.80 < V9.80), SIPROTEC 5 7VU85 (CP300) (All versions < V9.80), SIPROTEC 5 Compact 7SX800 (CP050) (All versions < V9.80). Affected devices do not properly limit the path accessible via their webserver. This could allow an authenticated remote attacker to read arbitrary files from the filesystem of affected devices.

Scores

CVSSScoreVectorSource
4.07.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:Nsiemens
3.16.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsiemens

Weaknesses

  • CWE-552 Files or Directories Accessible to External Parties

Affected Products

ProductVersions
SIPROTEC 5 6MD84 (CP300)Siemens
  • before V9.80Affected
SIPROTEC 5 6MD85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 6MD86 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 6MD89 (CP300)Siemens
  • V7.80 to before V9.68Affected
SIPROTEC 5 6MU85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7KE85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SA82 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7SA82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SA86 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SA87 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SD82 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7SD82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SD86 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SD87 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SJ81 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7SJ81 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SJ82 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7SJ82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SJ85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SJ86 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SK82 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7SK82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SK85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SL82 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7SL82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SL86 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SL87 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7SS85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7ST85 (CP300)Siemens
  • before V9.68Affected
SIPROTEC 5 7ST86 (CP300)Siemens
  • before V9.80Affected
SIPROTEC 5 7SX82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7SX85 (CP300)Siemens
  • before V9.80Affected
SIPROTEC 5 7SY82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7UM85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7UT82 (CP100)Siemens
  • V7.80 to before V8.90Affected
SIPROTEC 5 7UT82 (CP150)Siemens
  • before V9.80Affected
SIPROTEC 5 7UT85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7UT86 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7UT87 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7VE85 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7VK87 (CP300)Siemens
  • V7.80 to before V9.80Affected
SIPROTEC 5 7VU85 (CP300)Siemens
  • before V9.80Affected
SIPROTEC 5 Compact 7SX800 (CP050)Siemens
  • before V9.80Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.