CVE-2024-0860 Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator
Attackers can capture cleartext sensitive information to craft malicious requests against Softing edgeConnector and edgeAggregator industrial systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-0860?
CVE-2024-0860 is a high-severity vulnerability in Softing edgeAggregator, published on 14 Mar 2024. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.
Weakness: CWE-319
Which versions are affected by CVE-2024-0860?
It affects 2 products.
Products include Softing Edgeaggregator, Softing Edgeconnector.
How do I fix CVE-2024-0860?
No fix has been published for CVE-2024-0860 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-0860 being exploited?
There is no known exploitation of CVE-2024-0860 in the wild and no public exploit code.
Other vulnerabilities in Softing edgeAggregator
- CVE-2022-2336 Softing Secure Integration Server Improper Authentication
- CVE-2023-27335 Softing edgeAggregator Client Cross-Site Scripting Remote Code Execution Vulnerability
- CVE-2023-27334 Softing edgeConnector Siemens ConditionRefresh Resource Exhaustion Denial-of-Service Vulnerability
- CVE-2023-27336 Softing edgeConnector Siemens OPC UA Server Null Pointer Dereference Denial-of-Service Vulnerability
- CVE-2023-38125 Softing edgeAggregator Permissive Cross-domain Policy with Untrusted Domains Remote Code Execution Vulnerability
Sources
Also known as GHSA-xc3v-gxv5-4x7q.