Summary: Siemens has issued a security advisory regarding critical vulnerabilities in its InterMesh wireless alarm reporting system, which could allow remote attackers to execute arbitrary code with root privileges. The most severe vulnerability, CVE-2024-47901, has a CVSSv4 score of 10.0, highlighting the urgent need for users to update their systems to mitigate risks.
Threat Actor: Unauthenticated Remote Attacker | unauthenticated remote attacker
Victim: Siemens InterMesh Users | Siemens InterMesh Users
Key Point :
- Multiple vulnerabilities in InterMesh could allow remote code execution with root privileges.
- CVE-2024-47901 is the most critical, with a CVSSv4 score of 10.0, indicating severe risk.
- Other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) further increase the threat landscape.
- Siemens recommends immediate updates to affected devices to mitigate risks.
- Users should restrict access to the InterMesh network to trusted systems and personnel.
Siemens has issued a security advisory addressing multiple vulnerabilities in its InterMesh wireless alarm reporting system. These vulnerabilities could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges on affected devices.
InterMesh is utilized in critical infrastructure and industrial settings for fast and reliable alarm signal delivery. The vulnerabilities stem from inadequate input sanitization and authentication within the web server of InterMesh Subscriber devices.
The most critical vulnerability identified is CVE-2024-47901, which carries a CVSSv4 score of 10.0—the highest possible severity rating. According to Siemens, “The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level.” This vulnerability allows an unauthenticated remote attacker to execute arbitrary code with root privileges, posing a significant threat to system integrity.
This vulnerability, when combined with three others—CVE-2024-47902, CVE-2024-47903, and CVE-2024-47904—further increases the risk. Siemens highlights the interconnected nature of these flaws, stating that together, they “could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.”
The secondary vulnerabilities are also concerning:
- CVE-2024-47902 (CVSSv4 6.9) allows for unauthenticated execution of specific commands (such as ping) on the operating system level.
- CVE-2024-47903 (CVSSv4 6.9) enables attackers to write arbitrary files to the web server’s DocumentRoot directory.
- CVE-2024-47904 (CVSSv4 8.5) exploits a SUID binary, allowing authenticated local attackers to execute arbitrary commands with root privileges.
The affected products include:
- InterMesh 7177 Hybrid 2.0 Subscriber: All versions < V8.2.12
- InterMesh 7707 Fire Subscriber: All versions < V7.2.12 (only if the IP interface is enabled)
Siemens has provided immediate remediation steps, advising users to update the affected InterMesh devices to the latest versions:
- InterMesh 7177 Hybrid 2.0 Subscriber: Update to version V8.2.12 or later.
- InterMesh 7707 Fire Subscriber: Update to version V7.2.12 or later, or alternatively, disable the IP interface to mitigate risk.
In addition to updating, Siemens advises users to restrict access to the InterMesh network to trusted systems and personnel only.
Given the severity of these vulnerabilities, particularly CVE-2024-47901, Siemens is urging users to update their systems immediately. Failure to do so could leave systems vulnerable to attacks that could result in complete system compromise.
Related Posts:
Source: https://securityonline.info/cve-2024-47901-cvss-10-critical-security-flaw-in-siemens-intermesh