CVE-2024-46887

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-08 · updated 2026-06-17
Weakness: CWE-288

Description

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum communication load.

Affected products

Siemens SIMATIC Drive Controller CPU 1504D TF: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC Drive Controller CPU 1507D TF: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC ET 200SP CPU 1510SP-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC ET 200SP CPU 1512SP-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC ET 200SP CPU 1514SP-2 PN: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS: before V21.9.8 — fixed in V21.9.8
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS: before V31.1.4 — fixed in V31.1.4
Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Windows OS: before V31.1.4 — fixed in V31.1.4
Siemens SIMATIC S7-1500 CPU 1511-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1511C-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1511F-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1511T-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1511TF-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1512C-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1513-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1513F-1 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1513pro-2 PN: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC S7-1500 CPU 1513pro F-2 PN: before V3.1.4 — fixed in V3.1.4
Siemens SIMATIC S7-1500 CPU 1515-2 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1515F-2 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1515T-2 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1515TF-2 PN: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1516-3 PN/DP: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1516F-3 PN/DP: before V2.9.8; before V3.1.4 — fixed in V2.9.8, V3.1.4
Siemens SIMATIC S7-1500 CPU 1516pro-2 PN: before V3.1.4 — fixed in V3.1.4

How to fix

Upgrade to a fixed version: Siemens SIMATIC Drive Controller CPU 1504D TF V3.1.4; Siemens SIMATIC Drive Controller CPU 1507D TF V3.1.4; Siemens SIMATIC ET 200SP CPU 1510SP-1 PN V2.9.8, V3.1.4; Siemens SIMATIC ET 200SP CPU 1510SP F-1 PN V2.9.8, V3.1.4; Siemens SIMATIC ET 200SP CPU 1512SP-1 PN V2.9.8, V3.1.4; Siemens SIMATIC ET 200SP CPU 1512SP F-1 PN V2.9.8, V3.1.4; Siemens SIMATIC ET 200SP CPU 1514SP-2 PN V3.1.4; Siemens SIMATIC ET 200SP CPU 1514SP F-2 PN V3.1.4; Siemens SIMATIC ET 200SP CPU 1514SPT-2 PN V3.1.4; Siemens SIMATIC ET 200SP CPU 1514SPT F-2 PN V3.1.4; Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V2 CPUs - Windows OS V21.9.8; Siemens SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) V3 CPUs - Industrial OS V31.1.4. Check the vendor advisory for mitigations.

References

https://cert-portal.siemens.com/productcert/html/ssa-054046.html

Get alerted when CVE-2024-46887 or the next vulnerability affects your stack