Skip to content
Fencer Intel
high 7.8

CVE-2024-38876 json

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All ve…

published 2y ago modified 4mo ago also EUVD-2024-37657

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 15%
public exploits
0
none known

Summary

A vulnerability has been identified in Omnivise T3000 Application Server R9.2 (All versions), Omnivise T3000 Domain Controller R9.2 (All versions), Omnivise T3000 Product Data Management (PDM) R9.2 (All versions), Omnivise T3000 R8.2 SP3 (All versions), Omnivise T3000 R8.2 SP4 (All versions), Omnivise T3000 Terminal Server R9.2 (All versions), Omnivise T3000 Thin Client R9.2 (All versions), Omnivise T3000 Whitelisting Server R9.2 (All versions). The affected application regularly executes user modifiable code as a privileged user. This could allow a local authenticated attacker to execute arbitrary code with elevated privileges.

Is CVE-2024-38876 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2y ago

Exploit prediction

0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:T/RC:C
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Siemens Omnivise T3000 Application Server R9.2
  • Siemens Omnivise T3000 Domain Controller R9.2
  • Siemens Omnivise T3000 Product Data Management (PDM) R9.2
  • Siemens Omnivise T3000 R8.2 SP3
  • Siemens Omnivise T3000 R8.2 SP4
  • Siemens Omnivise T3000 Terminal Server R9.2
  • Siemens Omnivise T3000 Thin Client R9.2
  • Siemens Omnivise T3000 Whitelisting Server R9.2
  • siemens omnivise_t3000_application_server_r9.2
  • siemens omnivise_t3000_domain_controller_r9.2
  • siemens omnivise_t3000_product_data_management_r9.2
  • siemens omnivise_t3000_r8.2_sp3
  • siemens omnivise_t3000_r82_sp4
  • siemens omnivise_t3000_terminal_server_r9.2
  • siemens omnivise_t3000_thin_client_r9.2
  • siemens omnivise_t3000_whitelisting_server_r9.2

Classification

Weakness
  • CWE-552 Files or Directories Accessible to External Parties

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.