Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Siemens TeleControl Server Basic Deserialization Vulnerability

Critical

Synopsis

A .NET deserialization vulnerability exists in Siemens TeleControl Server Basic (TCSB) prior to V3.1.2.1. An unauthenticated remote attacker can exploit it to execute arbitrary code under the security context of SYSTEM.

Solution

Update to V3.1.2.1 or later.

Disclosure Timeline

July 4, 2024 - Tenable discloses to Siemens. Siemens acknowledges.
July 10, 2024 - Siemens requests clarification. Tenable provides clarification. Siemens acknowledges.
July 11, 2024 - Siemens states that provided information was sufficient.
August 16, 2024 - Siemens requests deadline extension to November 12 patching cycle and provides reasoning for delay.
August 19, 2024 - Tenable acknowledges and accepts deadline extension request. Siemens acknowledges.
September 23, 2024 - Tenable requests status update.
September 24, 2024 - Siemens provides status update and requests attribution information.
September 25, 2024 - Tenable provides requested information.
October 22, 2024 - Siemens provides advisory draft.
November 4, 2024 - Tenable provides advisory draft. Siemens acknowledges.
November 12, 2024 - Coordinated disclosure.

All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.

Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.

For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.

If you have questions or corrections about this advisory, please email [email protected]

Risk Information

CVE ID: CVE-2024-44102
Tenable Advisory ID: TRA-2024-46
CVSSv3 Base / Temporal Score:
10.0 / 9.0
CVSSv3 Vector:
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products:
TeleControl Server Basic V3.1 and prior
Risk Factor:
Critical

Advisory Timeline

November 12, 2024 - Initial release.