Skip to content
Fencer Vulns
high 8.2

CVE-2024-38877 json

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All ve…

published 2024-08-02 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-37658

cvss
8.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 8%
public exploits
0
none known

Summary

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Security Server R9.2 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected devices stores initial system credentials without sufficient protection. An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss allowing the attacker to laterally move within the affected network.

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.19% chance of exploitation in the next 30 days, higher than 8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C
CNA 4.0 8.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H
CNA 4.0 8.3 CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 8.2 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

  • Siemens Omnivise T3000 Application Server R9.2
  • Siemens Omnivise T3000 Domain Controller R9.2
  • Siemens Omnivise T3000 Network Intrusion Detection System (NIDS) R9.2
  • Siemens Omnivise T3000 Product Data Management (PDM) R9.2
  • Siemens Omnivise T3000 R8.2 SP3
  • Siemens Omnivise T3000 R8.2 SP4
  • Siemens Omnivise T3000 Security Server R9.2
  • Siemens Omnivise T3000 Terminal Server R9.2
  • Siemens Omnivise T3000 Thin Client R9.2
  • Siemens Omnivise T3000 Whitelisting Server R9.2
  • siemens omnivise_t3000_application_server
  • siemens omnivise_t3000_domain_controller
  • siemens omnivise_t3000_nids
  • siemens omnivise_t3000_pdim
  • siemens omnivise_t3000_security_server
  • siemens omnivise_t3000_terminal_server
  • siemens omnivise_t3000_thin_client
  • siemens omnivise_t3000_whitelisting_server

Classification

Weakness
  • CWE-312 Cleartext Storage of Sensitive Information

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.