CVE-2024-46886: siemens simatic drive controller cpu 1504d tf Open Redirect

Vulnerability summary

CVE-2024-46886 is a medium (CVSS 5.1) Open Redirect vulnerability in siemens simatic drive controller cpu 1504d tf. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33.1% of scored vulnerabilities.

Timeline

1. 08-10-2024
   PublishedVulnerability first disclosed.
2. 14-10-2025
   Last modifiedVulnerability information updated.

Description

The web server of affected devices does not properly validate input that is used for a user redirection. This could allow an attacker to make the server redirect the legitimate user to an attacker-chosen URL. For a successful exploit, the legitimate user must actively click on an attacker-crafted link.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.