{"cve":"CVE-2024-37990","nvd":{"published":"2024-09-10T10:15:10.227","modified":"2026-06-17T07:39:10.443","status":"Analyzed","description":"A vulnerability has been identified in SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0) (All versions < V4.2), SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0) (All versions < V4.2), SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0) (All versions < V4.2), SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0) (All versions < V4.2), SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0) (All versions < V4.2), SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0) (All versions < V4.2), SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0) (All versions < V4.2), SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0) (All versions < V4.2), SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0) (All versions < V4.2), SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0) (All versions < V4.2), SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0) (All versions < V4.2), SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0) (All versions < V4.2), SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0) (All versions < V4.2), SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0) (All versions < V4.2), SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0) (All versions < V4.2), SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0) (All versions < V4.2), SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0) (All versions < V4.2), SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0) (All versions < V4.2), SIMATIC RF1140R (6GT2831-6CB00) (All versions < V1.1), SIMATIC RF1170R (6GT2831-6BB00) (All versions < V1.1), SIMATIC RF166C (6GT2002-0EE20) (All versions < V2.2), SIMATIC RF185C (6GT2002-0JE10) (All versions < V2.2), SIMATIC RF186C (6GT2002-0JE20) (All versions < V2.2), SIMATIC RF186CI (6GT2002-0JE50) (All versions < V2.2), SIMATIC RF188C (6GT2002-0JE40) (All versions < V2.2), SIMATIC RF188CI (6GT2002-0JE60) (All versions < V2.2), SIMATIC RF360R (6GT2801-5BA30) (All versions < V2.2). The affected applications contain configuration files which can be modified. An attacker with privilege access can modify these files and enable features that are not released for this device.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N","score":7.0},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","score":6.5},"cwes":["CWE-912"],"references":["https://cert-portal.siemens.com/productcert/html/ssa-765405.html"],"products":["siemens:simatic_reader_rf610r_cmiit_firmware","siemens:simatic_reader_rf610r_etsi_firmware","siemens:simatic_reader_rf610r_fcc_firmware","siemens:simatic_reader_rf615r_cmiit_firmware","siemens:simatic_reader_rf615r_etsi_firmware","siemens:simatic_reader_rf615r_fcc_firmware","siemens:simatic_reader_rf650r_arib_firmware","siemens:simatic_reader_rf650r_cmiit_firmware","siemens:simatic_reader_rf650r_etsi_firmware","siemens:simatic_reader_rf650r_fcc_firmware","siemens:simatic_reader_rf680r_arib_firmware","siemens:simatic_reader_rf680r_cmiit_firmware","siemens:simatic_reader_rf680r_etsi_firmware","siemens:simatic_reader_rf680r_fcc_firmware","siemens:simatic_reader_rf685r_arib_firmware","siemens:simatic_reader_rf685r_cmiit_firmware","siemens:simatic_reader_rf685r_etsi_firmware","siemens:simatic_reader_rf685r_fcc_firmware","siemens:simatic_rf1140r_firmware","siemens:simatic_rf1170r_firmware","siemens:simatic_rf166c_firmware","siemens:simatic_rf185c_firmware","siemens:simatic_rf186c_firmware","siemens:simatic_rf186ci_firmware","siemens:simatic_rf188c_firmware","siemens:simatic_rf188ci_firmware","siemens:simatic_rf360r_firmware"],"source":"nvd","synced_at":"2026-10-19T21:54:38.012257375+00:00"},"epss":{"cve":"CVE-2024-37990","score":0.00407,"percentile":0.34955,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}