CVE-2024-47901: OS Command Injection
First published: Wed Oct 23 2024(Updated: )
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The web server of affected devices does not sanitize the input parameters in specific GET requests that allow for code execution on operating system level. In combination with other vulnerabilities (CVE-2024-47902, CVE-2024-47903, CVE-2024-47904) this could allow an unauthenticated remote attacker to execute arbitrary code with root privileges.
Credit: productcert@siemens.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Siemens Intermesh 7177 Hybrid 2.0 Subscriber | <8.2.12 | |
| Siemens Intermesh 7177 Hybrid 2.0 Subscriber | ||
| All of | ||
| Siemens Intermesh 7707 Fire Subscriber Firmware | <7.2.12 | |
| Siemens Intermesh 7707 Fire Subscriber |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-47901?
CVE-2024-47901 is considered to have a high severity due to the potential for input sanitization flaws in the affected web servers.
How do I fix CVE-2024-47901?
To mitigate CVE-2024-47901, update the InterMesh 7177 Hybrid to version 8.2.12 or later, and the 7707 Fire Subscriber to version 7.2.12 or later.
Who is affected by CVE-2024-47901?
CVE-2024-47901 affects all versions of InterMesh 7177 Hybrid prior to 8.2.12 and the 7707 Fire Subscriber prior to 7.2.12 when the IP interface is enabled.
What products are impacted by CVE-2024-47901?
CVE-2024-47901 impacts Siemens InterMesh 7177 Hybrid 2.0 Subscriber and InterMesh 7707 Fire Subscriber devices with specific version vulnerabilities.
Is the IP interface enabled by default for CVE-2024-47901?
No, the IP interface is not the default configuration for the affected InterMesh 7707 Fire Subscriber devices.
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- vendor/siemens
- canonical/siemens intermesh 7177 hybrid 2.0 subscriber
- canonical/siemens intermesh 7707 fire subscriber firmware
- canonical/siemens intermesh 7707 fire subscriber