cbcvebase.
CVE-2024-46887
published 2024-10-08

CVE-2024-46887: The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an…

PriorityP334medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.54%
41.8th percentile
The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.

Affected

105 ranges· showing 25
VendorProductVersion rangeFixed in
siemenssimatic_drive_controller_cpu_1504d_tf< V3.1.4V3.1.4
siemenssimatic_drive_controller_cpu_1507d_tf< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1510sp-1_pn< V2.9.8V2.9.8
siemenssimatic_et_200sp_cpu_1510sp-1_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1510sp_f-1_pn< V2.9.8V2.9.8
siemenssimatic_et_200sp_cpu_1510sp_f-1_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1512sp-1_pn< V2.9.8V2.9.8
siemenssimatic_et_200sp_cpu_1512sp-1_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1512sp_f-1_pn< V2.9.8V2.9.8
siemenssimatic_et_200sp_cpu_1512sp_f-1_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1514sp-2_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1514sp_f-2_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1514spt-2_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_cpu_1514spt_f-2_pn< V3.1.4V3.1.4
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc2_v2_cpus_windows_os< V21.9.8V21.9.8
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus_industrial_os< V31.1.4V31.1.4
siemenssimatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus_windows_os< V31.1.4V31.1.4
siemenssimatic_s7-1500_cpu_1511-1_pn< V2.9.8V2.9.8
siemenssimatic_s7-1500_cpu_1511-1_pn< V3.1.4V3.1.4
siemenssimatic_s7-1500_cpu_1511c-1_pn< V2.9.8V2.9.8
siemenssimatic_s7-1500_cpu_1511c-1_pn< V3.1.4V3.1.4
siemenssimatic_s7-1500_cpu_1511f-1_pn< V2.9.8V2.9.8
siemenssimatic_s7-1500_cpu_1511f-1_pn< V3.1.4V3.1.4
siemenssimatic_s7-1500_cpu_1511t-1_pn< V2.9.8V2.9.8
siemenssimatic_s7-1500_cpu_1511t-1_pn< V3.1.4V3.1.4

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.