{"id":"CVE-2024-41681","aliases":["EUVD-2024-39126","GHSA-8wvx-w97g-7fq3"],"status":"published","title":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The...","description":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00161,"percentile":0.05361,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-326"],"published":"2024-08-13T07:54:18Z","modified":"2026-06-17T07:48:02Z","products":[{"vendor":"siemens","product":"location intelligence family"},{"vendor":"siemens","product":"location_intelligence"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-720392.html","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-41681"},{"url":"https://github.com/advisories/GHSA-8wvx-w97g-7fq3"}],"sources":{"cve":[{"id":"CVE-2024-41681","description":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.","status":"published","published":"2024-08-13T07:54:18.686Z","modified":"2024-08-13T13:50:59.341Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H/E:P/RL:O/RC:C","level":"medium","assessor":"cna"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:34:04.00829Z"}],"euvd":[{"id":"EUVD-2024-39126","description":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.","status":"published","published":"2024-08-13T07:54:18Z","modified":"2024-08-13T13:50:59Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-03T00:56:19.192984Z"}],"ghsa":[{"id":"GHSA-8wvx-w97g-7fq3","title":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The...","description":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.","status":"published","published":"2024-08-13T09:30:52Z","modified":"2024-08-13T09:30:58Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:57:56.424434Z"}],"nvd":[{"id":"CVE-2024-41681","description":"A vulnerability has been identified in Location Intelligence family (All versions \u003c V4.4). The web server of affected products is configured to support weak ciphers  by default. This could allow an unauthenticated attacker in an on-path position to to read and modify any data passed over the connection between legitimate clients and the affected device.","status":"published","published":"2024-08-13T08:15:11.847Z","modified":"2026-06-17T07:48:02.237Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:P/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:10:18.563492Z"}]}}