CVE-2024-47904: High severity siemens intermesh 7177 hybrid 2.0 subscriber vulnerability
A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber (All versions < V8.2.12), InterMesh 7707 Fire Subscriber (All versions < V7.2.12 only if the IP interface is enabled (which is not the default configuration)). The affected devices contain a SUID binary that could allow an authenticated local attacker to execute arbitrary commands with root privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47904?
CVE-2024-47904 is classified as a high-severity vulnerability due to the potential for unauthorized access through a SUID binary.
How do I fix CVE-2024-47904?
To fix CVE-2024-47904, upgrade to Siemens InterMesh 7177 Hybrid version 8.2.12 or InterMesh 7707 Fire Subscriber version 7.2.12 or later.
Which devices are affected by CVE-2024-47904?
CVE-2024-47904 affects all versions of Siemens InterMesh 7177 Hybrid below 8.2.12 and InterMesh 7707 Fire Subscriber below 7.2.12 when the IP interface is enabled.
What does SUID binary mean in the context of CVE-2024-47904?
A SUID binary in this context refers to a file that allows users to execute it with the permissions of the file owner, potentially leading to privilege escalation.
Is the IP interface enabled by default for InterMesh 7707 Fire Subscriber regarding CVE-2024-47904?
No, the IP interface is not enabled by default for InterMesh 7707 Fire Subscriber, but if enabled, it makes the device vulnerable.