TI-2024-32058 Aliases CVE-2024-47783 GHSA-fvc2-gqm9-w9x5

Incorrect permission assignment in Siemens SIPORT

LOW 38CWE-732Published 2024-11-12 · Updated 2024-11-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

A vulnerability has been identified in SIPORT (All versions < V3.4.0). The affected application improperly assigns file permissions to installation folders. This could allow a local attacker with an unprivileged account to override or modify the service executables and subsequently gain elevated privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00142 3rd percentileScored 2026-11-07

Fix Fixed SIPORT (Siemens): V3.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	SIPORT	before V3.4.0	V3.4.0	Patch available	CNA

SIPORT VendorSiemens Affected before V3.4.0 Fixed in V3.4.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:siemens:siport::::::::	before 3.4.0	Vulnerable	Siemens

cpe:2.3:a:siemens:siport:*:*:*:*:*:*:*:* Versions before 3.4.0 Vulnerable ·Siemens

Remediation

Fix · CNA SIPORT (Siemens) Fixed in V3.4.0

Timeline

2026-10-02 Threatist record created from CVE-2024-47783
2026-10-03 Alias added: GHSA-fvc2-gqm9-w9x5

References

Advisory 1

https://cert-portal.siemens.com/productcert/html/ssa-064257.html

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences