Description
A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions < V4.3), Location Intelligence Perpetual Medium (9DE5110-8CA12-1AX0) (All versions < V4.3), Location Intelligence Perpetual Non-Prod (9DE5110-8CA10-1AX0) (All versions < V4.3), Location Intelligence Perpetual Small (9DE5110-8CA11-1AX0) (All versions < V4.3), Location Intelligence SUS Large (9DE5110-8CA13-1BX0) (All versions < V4.3), Location Intelligence SUS Medium (9DE5110-8CA12-1BX0) (All versions < V4.3), Location Intelligence SUS Non-Prod (9DE5110-8CA10-1BX0) (All versions < V4.3), Location Intelligence SUS Small (9DE5110-8CA11-1BX0) (All versions < V4.3). Affected products use a hard-coded secret value for the computation of a Keyed-Hash Message Authentication Code. This could allow an unauthenticated remote attacker to gain full administrative access to the application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Location Intelligence Perpetual Large | < V4.3 | V4.3 |
| Siemens | Location Intelligence Perpetual Medium | < V4.3 | V4.3 |
| Siemens | Location Intelligence Perpetual Non-Prod | < V4.3 | V4.3 |
| Siemens | Location Intelligence Perpetual Small | < V4.3 | V4.3 |
| Siemens | Location Intelligence SUS Large | < V4.3 | V4.3 |
| Siemens | Location Intelligence SUS Medium | < V4.3 | V4.3 |
| Siemens | Location Intelligence SUS Non-Prod | < V4.3 | V4.3 |
| Siemens | Location Intelligence SUS Small | < V4.3 | V4.3 |
Advisories 2
- ICSA-24-046-05 Siemens Location Intelligence CISA ICS & IT advisories · Feb 13, 2024
- SSA-580228 SSA-580228: Use of Hard-Coded Credentials Vulnerability in Location Intelligence before V4.3 Siemens ProductCERT · Feb 13, 2024