CVE-2024-31484

No fix known EPSS <1%CVSS 7.8

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Published 2024-05-14 · CVE record · OSV

Products: Siemens CPC80 Central Processing/Communication, Siemens CPCI85 Central Processing/Communication, Siemens CPCX26 Central Processing/Communication, Siemens ETA4 Ethernet Interface IEC60870-5-104, Siemens ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2, Siemens PCCX26 Ax 1703 PE, Contr, Communication Element