CVE-2024-41977

A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.1), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.1), SCALANCE M812-1 ADSL-Router family (All versions < V8.1), SCALANCE M816-1 ADSL-Router family (All versions < V8.1), SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2) (All versions < V8.1), SCALANCE M874-2 (6GK5874-2AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 (6GK5874-3AA00-2AA2) (All versions < V8.1), SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2) (All versions < V8.1), SCALANCE M876-3 (6GK5876-3AA02-2BA2) (All versions < V8.1), SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2) (All versions < V8.1), SCALANCE M876-4 (6GK5876-4AA10-2BA2) (All versions < V8.1), SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2) (All versions < V8.1), SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2) (All versions < V8.1), SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1) (All versions < V8.1), SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1) (All versions < V8.1), SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1) (All versions < V8.1), SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1) (All versions < V8.1), SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1) (All versions < V8.1), SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1) (All versions < V8.1), SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1) (All versions < V8.1), SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1) (All versions < V8.1), SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2) (All versions < V8.1), SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2) (All versions < V8.1). Affected devices do not properly enforce isolation between user sessions in their web server component. This could allow an authenticated remote attacker to escalate their privileges on the devices.

Scoring

Severity

HIGH

CVSS base score

7.3

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS probability

0.44%

CWE

CWE-488

Published

2024-08-13

Last modified

2026-03-13

Affected products

• Siemens RUGGEDCOM RM1224 LTE(4G) EU
• Siemens RUGGEDCOM RM1224 LTE(4G) NAM
• Siemens SCALANCE M804PB
• Siemens SCALANCE M812-1 ADSL-Router family
• Siemens SCALANCE M816-1 ADSL-Router family
• Siemens SCALANCE M826-2 SHDSL-Router
• Siemens SCALANCE M874-2
• Siemens SCALANCE M874-3

Weakness type

• CWE-488

Related vulnerabilities

• CVE-2026-84685 — Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
• CVE-2026-86492 — In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub...
• CVE-2026-18489 — IBM ContextForge Translate is affected by cross-client credential context confusion
• CVE-2026-82367 — Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
• CVE-2026-71850 — Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
• CVE-2026-16326 — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
• CVE-2026-16498 — terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
• CVE-2026-54497 — view_component: Reused Component Instances Retain Stale Render Context

Markdown version · Browse all CVEs