CVE-2024-32742

HighCVSS 7.6/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in SIMATIC CN 4100 (All versions < V3.0). The affected device contains an unrestricted USB port. An attacker with local access to the device could potentially misuse the port for booting another operating system and gain complete read/write access to the filesystem.

Metrics

CVSS 3.1 7.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-1326

Affected software

Vendor	Product	Versions
Siemens	SIMATIC CN 4100	< V3.0
siemens	simatic_cn_4100	< 3.0

References

https://cert-portal.siemens.com/productcert/html/ssa-273900.htmlVendor Advisory
https://cert-portal.siemens.com/productcert/html/ssa-273900.htmlVendor Advisory

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-327435.5A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or CVE-2024-327444.6A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or CVE-2024-327455.9A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or CVE-2024-327464.6A cross-site scripting (XSS) vulnerability in the Settings section of WonderCMS v3.4.3 allows attackers to execute arbitrary web scripts or CVE-2024-32754.3The eRoom – Zoom Meetings & Webinars plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi CVE-2024-327529.1The iSTAR door controllers running firmware prior to version 6.6.B, does not support authenticated communications with ICU, which may allow CVE-2024-327537.0Under certain circumstances the camera may be susceptible to known vulnerabilities associated with the JQuery versions prior to 3.5.0 third-CVE-2024-327543.1Under certain circumstances, when the controller is in factory reset mode waiting for initial setup, it will broadcast its MAC address, seri CVE-2024-327559.1Under certain circumstances the web interface will accept characters unrelated to the expected input.CVE-2024-327566.8Under certain circumstances the Linux users credentials may be recovered by an authenticated user.CVE-2024-327576.8Under certain circumstances unnecessary user details are provided within system logs CVE-2024-327587.5Under certain circumstances the communication between exacqVision Client and exacqVision Server will use insufficient key length and exchang