CVE-2024-31853
BaseFortify
Publication date: 2025-07-08
Last updated on: 2025-08-20
Assigner: Siemens AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| siemens | sicam_toolbox_ii | to 07.11 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in SICAM TOOLBOX II versions before V07.11. When establishing an HTTPS connection to the TLS server of a managed device, the application does not verify the extended key usage attribute of the device's certificate. This flaw could allow an attacker to perform a man-in-the-middle (MitM) attack by intercepting and potentially altering the communication.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to execute an on-path (MitM) attack, which means the attacker could intercept, modify, or eavesdrop on the communication between the application and the managed device. This could lead to unauthorized access, data manipulation, or exposure of sensitive information.