CVE-2024-46887

published 2024-10-08

CVE-2024-46887: The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an…

medium 6.9 CVSS 4.0

AV N AC L AT N PR N UI N VC L VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.

Affected

105 ranges · showing 25

Vendor	Product	Version range	Fixed in
siemens	simatic_drive_controller_cpu_1504d_tf	< V3.1.4	V3.1.4
siemens	simatic_drive_controller_cpu_1507d_tf	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1510sp-1_pn	< V2.9.8	V2.9.8
siemens	simatic_et_200sp_cpu_1510sp-1_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1510sp_f-1_pn	< V2.9.8	V2.9.8
siemens	simatic_et_200sp_cpu_1510sp_f-1_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1512sp-1_pn	< V2.9.8	V2.9.8
siemens	simatic_et_200sp_cpu_1512sp-1_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1512sp_f-1_pn	< V2.9.8	V2.9.8
siemens	simatic_et_200sp_cpu_1512sp_f-1_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1514sp-2_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1514sp_f-2_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1514spt-2_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_cpu_1514spt_f-2_pn	< V3.1.4	V3.1.4
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc2_v2_cpus_windows_os	< V21.9.8	V21.9.8
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus_industrial_os	< V31.1.4	V31.1.4
siemens	simatic_et_200sp_open_controller_cpu_1515sp_pc2_v3_cpus_windows_os	< V31.1.4	V31.1.4
siemens	simatic_s7-1500_cpu_1511-1_pn	< V2.9.8	V2.9.8
siemens	simatic_s7-1500_cpu_1511-1_pn	< V3.1.4	V3.1.4
siemens	simatic_s7-1500_cpu_1511c-1_pn	< V2.9.8	V2.9.8
siemens	simatic_s7-1500_cpu_1511c-1_pn	< V3.1.4	V3.1.4
siemens	simatic_s7-1500_cpu_1511f-1_pn	< V2.9.8	V2.9.8
siemens	simatic_s7-1500_cpu_1511f-1_pn	< V3.1.4	V3.1.4
siemens	simatic_s7-1500_cpu_1511t-1_pn	< V2.9.8	V2.9.8
siemens	simatic_s7-1500_cpu_1511t-1_pn	< V3.1.4	V3.1.4

CWE-288 CWE-862