{
  "document": {
    "aggregate_severity": {
      "text": "Critical"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The information provided in this disclosure is provided \"as is\" without warranty of any kind.\nSofting disclaims all warranties, either express or implied, including the warranties of\nmerchantability and fitness for a particular purpose. In no event shall Softing or its suppliers be\nliable for any damages whatsoever including direct, indirect, incidental, consequential, loss of\nbusiness profits or special damages, even if Softing or its suppliers have been advised of the\npossibility of such damages.\nSome states do not allow the exclusion or limitation of liability for consequential or incidental\ndamages so the foregoing limitation may not apply.\n",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "Softing PSIRT - contact us at psirt@softing.com",
      "name": "Softing",
      "namespace": "https://industrial.softing.com"
    },
    "source_lang": "en-US",
    "title": "Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator",
    "tracking": {
      "current_release_date": "2026-07-24T10:00:00.000Z",
      "generator": {
        "date": "2026-07-24T11:28:23.788Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.6"
        }
      },
      "id": "SYT-2024-4",
      "initial_release_date": "2026-07-24T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-03-17T23:00:00.000Z",
          "number": "1.0.0",
          "summary": "Final version"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "product_version_range",
        "name": "Softing edgeConnector <= V3.70",
        "product": {
          "name": "Softing edgeConnector <= V3.70",
          "product_id": "CSAFPID-0001"
        }
      },
      {
        "category": "product_version_range",
        "name": "Softing edgeAggregator <= V3.70",
        "product": {
          "name": "Softing edgeAggregator <= V3.70",
          "product_id": "CSAFPID-0002"
        }
      },
      {
        "category": "product_version",
        "name": "Softing edgeConnector = V2024.01",
        "product": {
          "name": "Softing edgeConnector V2024.01 (successor of V4.00)",
          "product_id": "CSAFPID-0101"
        }
      },
      {
        "category": "product_version",
        "name": "Softing edgeAggregator = V2024.01",
        "product": {
          "name": "Softing edgeAggregator V2024.01 (successor of V4.00)",
          "product_id": "CSAFPID-0102"
        }
      },
      {
        "category": "product_version_range",
        "name": "Secure Information Server <= V1.30",
        "product": {
          "name": "Secure Integration Server (SIS) <= V1.30",
          "product_id": "CSAFPID-0003"
        }
      },
      {
        "category": "product_version",
        "name": "Suite NG = V2025.03",
        "product": {
          "name": "Suite NG - V2025.03  (successor of Secure Integration Server)",
          "product_id": "CSAFPID-0103"
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Pan ZhenPeng",
            "Li JianTao"
          ],
          "organization": "STAR Labs SG Pte. Ltd. working with Trend Micro Zero Day Initiative",
          "summary": "Vulnerability reported by"
        }
      ],
      "cve": "CVE-2024-0860",
      "cwe": {
        "id": "CWE-319",
        "name": "Cleartext Transmission of Sensitive Information"
      },
      "discovery_date": "2023-02-15T10:00:00.000Z",
      "notes": [
        {
          "category": "description",
          "text": "The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.",
          "title": "Description"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0101",
          "CSAFPID-0102",
          "CSAFPID-0103"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003"
        ]
      },
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 8,
            "temporalSeverity": "HIGH",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator"
    }
  ]
}