CVE-2024-42391

mediumpriority · track · 21EPSS 0.003 · 23 %ileDEEUNLUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.30% (23rd) EPSS

CVSS 5.3 · medium

Is it mine?

48 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · cisa_csaf_ot · ncsc_nl

EPSS · scored 2026-10-27

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedReyrolle 7SR5siemens_psirt
Update to V2.70 or later version
https://support.industry.siemens.com/cs/ww/en/view/109772413/
FixedReyrolle 7SR5cisa_csaf_ot
Update to V2.70 or later version
https://support.industry.siemens.com/cs/ww/en/view/109772413/

cvss

Technical severity, 0–10. One row per scoring source.

5.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · CISA US

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · prodsec@nozominetworks.comexploitability 2.8 · impact 1.4

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · Siemens ProductCERT DE

v3.14.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-823USCWE-823USCWE-823USCWE-823US

affected products (48)

Products and version ranges known to be affected.

Reyrolle 7SR5 < V2.70all versionscisa_csaf_otUS
Siemens Reyrolle 7SR5≤ vers:intdot/<2.70cisa_csaf_otUS
Cesanta Mongoose Web Server≤ 0 ≤7.14enisa_euvdEU
Siemens CPCI85 Central Processing/Communication≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC ClickOnce Client V6≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC ClickOnce Client V7≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC Flex Client V6≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC Flex Client V7≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC Installed Client V6≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC Installed Client V7≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC family V5.0≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC family V5.1≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC family V6≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC family V7≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC family V8≤ vers:unknown/*ncsc_nlNL
Siemens Desigo CC family V9≤ vers:unknown/*ncsc_nlNL
Siemens Industrial Edge Management≤ vers:unknown/*ncsc_nlNL
Siemens Reyrolle 7SR5≤ vers:unknown/*ncsc_nlNL
Siemens SCALANCE LPE9403≤ vers:unknown/*ncsc_nlNL
Siemens SIMATIC AX Runtime Core Linux Common Debian≤ vers:unknown/*ncsc_nlNL

showing 20 of 48

advisories (3)

Vendor and ecosystem advisories describing this.

NCSC-2026-0346Kwetsbaarheden verholpen in Siemens productenNL2026-09-08csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Desigo, Reyrolle, SIMATIC, SCALANCE, SINAMICS en Siveillance.
SSA-142885SSA-142885: Multiple Vulnerabilities in Reyrolle 7SR5 Before V2.702026-09-08csaf · siemens_psirtDE
Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version.
ICSA-26-258-05Siemens Reyrolle 7SR52026-09-08icsa · cisa_csaf_otUS
Siemens Reyrolle 7SR5 Before V2.70 is affected by multiple vulnerabilities. Siemens has released a new version for Reyrolle 7SR5 and recommends to update to the latest version.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2024-11-18modified 2026-09-08

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan