CVE-2024-54015 – SIPROTEC 5 SNMP Information Disclosure

A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions = V8.80 = V8.80 = V8.80 = V8.80 = V8.80), SIPROTEC 5 7SA82 (CP150) (All versions = V8.80 = V8.80 < V9.90), SIPROTEC 5 7SD82 (CP150) (All versions = V8.80 = V8.80 < V9.90), SIPROTEC 5 7SJ81 (CP150) (All versions < V9.90), SIPROTEC 5 7SJ82 (CP150) (All versions = V8.80 = V8.80 < V9.90), SIPROTEC 5 7SK82 (CP150) (All versions = V8.80 < V9.90), SIPROTEC 5 7SL82 (CP150) (All versions = V8.80 = V8.80 = V8.80 = V8.80), SIPROTEC 5 7ST86 (CP300) (All versions), SIPROTEC 5 7SX82 (CP150) (All versions = V8.80 < V9.90), SIPROTEC 5 7SY82 (CP150) (All versions = V8.80 < V9.90), SIPROTEC 5 7UT82 (CP150) (All versions = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 < V9.90), SIPROTEC 5 7VU85 (CP300) (All versions < V9.90), SIPROTEC 5 Communication Module ETH-BA-2EL (Rev.2) (All versions < V9.90), SIPROTEC 5 Communication Module ETH-BB-2FO (Rev. 2) (All versions = V8.80 = V9.50 < V9.90). Affected devices do not properly validate SNMP GET requests. This could allow an unauthenticated, remote attacker to retrieve sensitive information of the affected devices with SNMPv2 GET requests using default credentials.