CVE-2024-50558 Missing authorization in RUGGEDCOM RM1224 LTE(4G) EU
Improper access control for read-only users in Siemens SCALANCE routers allows attackers to cause a temporary denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-50558?
CVE-2024-50558 is a medium-severity missing authorization vulnerability in Siemens RUGGEDCOM RM1224 LTE(4G) EU, published on 12 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2), SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2) (All versions < V8.2), SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2) (All versions < V8.2), SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2) (All versions < V8.2), SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2) (All versions < V8.2), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.2), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.2), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.2), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.2), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.2), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.2), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.2), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.2), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.2), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.2), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.2), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.2), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.2), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.2), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.2), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.2), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.2), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.2), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.2). Affected devices improperly manage access control for read-only users. This could allow an attacker to cause a temporary denial of service condition.
Weakness: CWE-284
Which versions are affected by CVE-2024-50558?
It affects 26 products.
Products include Siemens Ruggedcom Rm1224 Lte\(4g\) Eu Firmware, Siemens Ruggedcom Rm1224 Lte\(4g\) Nam Firmware, Siemens Scalance M804pb Firmware, Siemens Scalance M812-1 \(Annex A\) Firmware, Siemens Scalance M812-1 \(Annex B\) Firmware, Siemens Scalance M816-1 \(Annex A\) Firmware and 20 more.
How do I fix CVE-2024-50558?
No fix has been published for CVE-2024-50558 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-50558 being exploited?
There is no known exploitation of CVE-2024-50558 in the wild and no public exploit code.
Other vulnerabilities in Siemens RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-50557 Command injection in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-50572 Command injection in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-41976 Code injection in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-41977 Privilege escalation in RUGGEDCOM RM1224 LTE(4G) EU
- CVE-2024-41978 Information disclosure in RUGGEDCOM RM1224 LTE(4G) EU
Sources
Also known as GHSA-qpp3-qr6x-mfmj.