PatchSiren cyber security CVE debrief

CVE-2024-5947 Deep Sea Electronics CVE debrief

Deep Sea Electronics DSE855 firmware version 1.0.26 contains an insecure direct object reference (IDOR) vulnerability that allows unauthenticated remote attackers to retrieve sensitive configuration data. The vulnerability exists because the device exposes the Backup.bin file through predictable URL paths without proper access controls. An attacker with adjacent network access can issue an HTTP GET request to directly reference this backup file and obtain configuration information. The CVSS 3.1 vector (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates this is an adjacent network attack with low complexity, no privileges required, and high confidentiality impact. The vendor has released firmware version 1.2.0 to address this vulnerability. Organizations using affected devices should apply the vendor update and restrict network access to these devices following ICS security best practices.

Vendor: Deep Sea Electronics
Product: DSE855
CVSS: MEDIUM 6.5
CISA KEV: Not listed in stored evidence
Original CVE published: 2024-10-24
Original CVE updated: 2024-10-24
Advisory published: 2024-10-24
Advisory updated: 2024-10-24

Who should care

Organizations operating Deep Sea Electronics DSE855 remote communications displays in power generation, marine, or industrial applications. Security teams managing OT/ICS networks with DSE855 devices deployed. Asset owners responsible for generator set control systems utilizing DSE855 modules for remote monitoring and configuration.

Technical summary

The DSE855 remote communications display module exposes the Backup.bin file through direct URL reference without authentication. An attacker on the same network segment can retrieve this file via HTTP GET request, obtaining device configuration data. The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key) or CWE-284 (Improper Access Control). No authentication is required, and the attack complexity is low. The confidentiality impact is rated HIGH as configuration files may contain credentials, network settings, or operational parameters. No integrity or availability impact is associated with this vulnerability.

Defensive priority

medium

Recommended defensive actions

Apply vendor firmware update to version 1.2.0 or later
Restrict network access to DSE855 devices to authorized administrative hosts only
Segment DSE855 devices from untrusted networks using firewall rules
Monitor for unauthorized HTTP GET requests targeting Backup.bin or similar backup files
Review device configurations for exposed sensitive data after compromise assessment
Implement defense-in-depth strategies per ICS-CERT recommended practices

Evidence notes

Vulnerability disclosed via CISA ICS advisory ICSA-24-298-03. Affected product confirmed as Deep Sea Electronics DSE855 firmware version 1.0.26. Vendor fix identified as version 1.2.0. CVSS 3.1 score of 6.5 (MEDIUM) assigned with adjacent network attack vector.

Sources and references

Verified primary and authoritative sources

CVE-2024-5947 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2024-5947

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2024-5947 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2024-5947

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-298-03.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-298-03

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.