Synthesis
Siemens has released security updates to fix multiple vulnerabilities, including 2 with “critical” severity, in its products – including SCADA.
Notes (updated 07/15/2024): A Proof of Concept (PoC) for the exploitation of CVE-2024-3596 is available online.
Risk
Estimated impact of vulnerability on the reference community: HIGH/ORANGE (71.85/100)1.
Type
- Arbitrary Code Execution
- Arbitrary File Write
- Data Manipulation
- Information Disclosure
- Privilege Escalation
- Security Restrictions Bypass
Affected products and/or versions
Siemens:
- JT2Go
- Mendix Encryption module
- RUGGEDCOM Products
- RUGGEDCOM ROS
- SCALANCE Products
- SIMATIC STEP 7 (TIA Portal)
- Simcenter Femap
- SINEMA Remote Connect Server
- Teamcenter Visualization
Mitigation actions
It is recommended that mitigation measures be implemented by following the instructions provided by the vendor for each affected product and reported in the security bulletins in the References section.
Unique vulnerability identifiers
Below are the only CVEs relating to vulnerabilities with “high” and “critical” severity:
References
https://cert-portal.siemens.com/productcert/html/ssa-064222.html
https://cert-portal.siemens.com/productcert/html/ssa-170375.html
https://cert-portal.siemens.com/productcert/html/ssa-381581.html
https://cert-portal.siemens.com/productcert/html/ssa-722010.html
https://cert-portal.siemens.com/productcert/html/ssa-723487.html
https://cert-portal.siemens.com/productcert/html/ssa-825651.html
https://cert-portal.siemens.com/productcert/html/ssa-868282.html
https://cert-portal.siemens.com/productcert/html/ssa-998949.html
1This estimate is carried out taking into account various parameters, including: CVSS, availability of patches/workarounds and PoC, diffusion of the affected software/devices in the reference community.
