CVE-2024-23816 Hardcoded credentials in Location Intelligence Perpetual Large
An unauthenticated remote attacker can gain full administrative access due to a hard-coded secret used for HMAC computation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-23816?
CVE-2024-23816 is a critical vulnerability in Siemens Location Intelligence Perpetual Large, published on 13 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.
Weakness: CWE-798
Which versions are affected by CVE-2024-23816?
It affects 1 product.
Products include Siemens Location Intelligence.
How do I fix CVE-2024-23816?
No fix has been published for CVE-2024-23816 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-23816 being exploited?
There is no known exploitation of CVE-2024-23816 in the wild and no public exploit code.
Other vulnerabilities in Siemens Location Intelligence Perpetual Large
Sources
Also known as GHSA-fh4v-qfgj-jxxw.