What is the CVSS score of CVE-2024-32742?

CVE-2024-32742 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Simatic Cn 4100 Firmware CVE-2024-32742

HIGH

Missing Immutable Root of Trust in Hardware (CWE-1326)

2024-05-14 productcert@siemens.com

Information Disclosure Simatic Cn 4100 Firmware

7.6

CVSS 3.1 · Vendor: siemens

Severity by source

Vendor (siemens) PRIMARY

7.6 HIGH

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (siemens) · only source for this CVE.

CVSS VectorVendor: siemens

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 14, 2024 - 16:17 cve.org

HIGH 7.6

DescriptionCVE.org

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem.

AnalysisAI

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). Rated high severity (CVSS 7.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-1326. A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem. Affected products include: Siemens Simatic Cn 4100 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.