CVE-2024-27947 Information disclosure in RUGGEDCOM CROSSBOW

Q: Is CVE-2024-27947 being exploited?

There is no known exploitation of CVE-2024-27947 in the wild and no public exploit code.

Q: How do I fix CVE-2024-27947?

No fix has been published for CVE-2024-27947 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 14 May 2024 Updated 2 Aug 2024

An attacker can forward log messages to a compromised client, leading to information disclosure in Siemens RUGGEDCOM CROSSBOW systems.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-27947?

CVE-2024-27947 is a medium-severity vulnerability in Siemens RUGGEDCOM CROSSBOW, published on 14 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems could allow log messages to be forwarded to a specific client under certain circumstances. An attacker could leverage this vulnerability to forward log messages to a specific compromised client.

Weakness: CWE-200

Which versions are affected by CVE-2024-27947?

It affects 1 product.

Products include Siemens Ruggedcom Crossbow.

How do I fix CVE-2024-27947?

No fix has been published for CVE-2024-27947 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-27947 being exploited?

There is no known exploitation of CVE-2024-27947 in the wild and no public exploit code.

Sources

Also known as GHSA-478c-g9v8-v6r2.