CVE-2024-47901: A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12…

PriorityP272critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.25%

65.6th percentile

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
siemens	intermesh_7177_hybrid_2.0_subscriber	< V8.2.12	V8.2.12
siemens	intermesh_7177_hybrid_2.0_subscriber	< 8.2.12	8.2.12
siemens	intermesh_7707_fire_subscriber	< V7.2.12	V7.2.12
siemens	intermesh_7707_fire_subscriber_firmware	< 7.2.12	7.2.12

Detection & IOCsextracted from sources · hover to see the quote

→The web server of affected Siemens InterMesh devices does not sanitize input parameters in specific GET requests, enabling OS command injection. Monitor for anomalous or unsanitized GET request parameters targeting the InterMesh web server interface. ↗
→The web server does not authenticate GET requests that execute specific OS-level commands such as ping. Detect unauthenticated GET requests invoking OS commands (e.g., ping) on InterMesh device web interfaces. ↗
→Affected devices allow writing arbitrary files to the web server's DocumentRoot directory via unauthenticated requests. Monitor for unexpected file creation events in the web server DocumentRoot on InterMesh devices. ↗
→A SUID binary on affected devices can be abused by an authenticated local attacker to execute arbitrary commands with root privileges. Audit SUID binaries on InterMesh devices for unexpected privilege escalation activity. ↗
→CVE-2024-47901 can be chained with CVE-2024-47902, CVE-2024-47903, and CVE-2024-47904 to achieve unauthenticated remote code execution as root. Correlate alerts across all four CVEs on InterMesh devices. ↗

·The InterMesh 7707 Fire Subscriber is only vulnerable if the IP interface is explicitly enabled, which is NOT the default configuration. Prioritize assessment of devices where the IP interface has been manually enabled. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.010.0CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.