CVE-2024-47901: critical vulnerability in Siemens InterMesh 7177 Hybrid 2.0 Subscriber
Published
Follow this CVE+ Monitor InterMesh 7177 Hybrid 2.0 Subscriber+ Monitor InterMesh 7707 Fire Subscriber
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 1.2%
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Siemens · InterMesh 7177 Hybrid 2.0 SubscriberSiemens · InterMesh 7707 Fire SubscriberRelated CVEs — Siemens InterMesh 7177 Hybrid 2.0 Subscriber
In the same product, most dangerous first.