Threat Investigation
Request a demo

CVE-2024-43781

Medium

Description

A vulnerability has been identified in SINUMERIK 828D V4 (All versions < V4.95 SP3), SINUMERIK 840D sl V4 (All versions < V4.95 SP3 in connection with using Create MyConfig (CMC) <= V4.8 SP1 HF6), SINUMERIK ONE (All versions < V6.23 in connection with using Create MyConfig (CMC) <= V6.6), SINUMERIK ONE (All versions < V6.15 SP4 in connection with using Create MyConfig (CMC) <= V6.6). Affected systems, that have been provisioned with Create MyConfig (CMC), contain a Insertion of Sensitive Information into Log File vulnerability. This could allow a local authenticated user with low privileges to read sensitive information and thus circumvent access restrictions.

SeverityMedium
CVSS5.5
Exploit probability—
ProductSINUMERIK 828D V4
PublishedSep 10, 2024
First seenSep 10, 2024
Weakness typeCWE-532CWE-532

How to fix

Update
  • Siemens SINUMERIK 828D V4V4.95 SP3 or later
  • Siemens SINUMERIK 840D sl V4V4.95 SP3 or later
  • Siemens SINUMERIK ONEV6.23, V6.15 SP4 or later

Affected products

ProductAffected versionsFixed in
Siemens SINUMERIK 828D V4v < V4.95 SP3V4.95 SP3
Siemens SINUMERIK 840D sl V4v < V4.95 SP3V4.95 SP3
Siemens SINUMERIK ONEv < V6.23, v < V6.15 SP4V6.23, V6.15 SP4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.