CVSS: 6.9EPSS: 0%CPEs: 87EXPL: 0CVE-2024-46887
https://notcve.org/view.php?id=CVE-2024-46887
The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load. • https://cert-portal.siemens.com/productcert/html/ssa-054046.html • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 5.1EPSS: 0%CPEs: 117EXPL: 0CVE-2024-46886
https://notcve.org/view.php?id=CVE-2024-46886
The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted link. • https://cert-portal.siemens.com/productcert/html/ssa-876787.html • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 6.8EPSS: 0%CPEs: 140EXPL: 0CVE-2022-38773
https://notcve.org/view.php?id=CVE-2022-38773
Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during load-time. An attacker with physical access to the device could use this to replace the boot image of the device and execute arbitrary code. • https://cert-portal.siemens.com/productcert/pdf/ssa-482757.pdf https://cert-portal.siemens.com/productcert/html/ssa-482757.html • CWE-1326: Missing Immutable Root of Trust in Hardware •
CVSS: 7.5EPSS: 0%CPEs: 192EXPL: 0CVE-2021-40365
https://notcve.org/view.php?id=CVE-2021-40365
Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device. Los dispositivos afectados no procesan correctamente ciertos paquetes especialmente manipulados enviados al puerto 102/tcp, lo que podría permitir a un atacante provocar una denegación de servicio en el dispositivo. • https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf • CWE-20: Improper Input Validation •
CVSS: 7.5EPSS: 0%CPEs: 192EXPL: 0CVE-2021-44695
https://notcve.org/view.php?id=CVE-2021-44695
Affected devices don't process correctly certain special crafted packets sent to port 102/tcp, which could allow an attacker to cause a denial of service in the device. Los dispositivos afectados no procesan correctamente ciertos paquetes especialmente manipulados enviados al puerto 102/tcp, lo que podría permitir a un atacante provocar una denegación de servicio en el dispositivo. • https://cert-portal.siemens.com/productcert/pdf/ssa-382653.pdf • CWE-20: Improper Input Validation CWE-1286: Improper Validation of Syntactic Correctness of Input •