Description

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Classification

CVE ID: CVE-2024-31484

CVSS Base Severity: HIGH

CVSS Base Score: 7.8

Affected Products

Vendor: Siemens

Product: CPC80 Central Processing/Communication

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 17.81% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://cert-portal.siemens.com/productcert/html/ssa-871704.html
https://cert-portal.siemens.com/productcert/html/ssa-620338.html
http://seclists.org/fulldisclosure/2024/Jul/4

Timeline