{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Steffen Robertz",
          "Gerhard Hechenberger",
          "Thomas Weber"
        ],
        "organization": "SEC Consult Vulnerability Lab",
        "summary": "reporting these vulnerabilities to Siemens."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: \n\n- \nSICAM A8000 device firmwares \n\n- CPC80 for CP-8000/CP-8021/CP-8022 \n- CPCI85 and OPUPI0 for CP-8031/CP-8050\n\n\n- \nSICAM EGS firmware \n\n- CPCI85 and OPUPI0\n\n\n- \nSICAM 8 Software Solution \n\n- SICORE \n\n\n\nSiemens has released new versions for the affected firmwares and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-871704.json"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-871704.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-871704.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-137-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-137-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-137-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SICAM Products",
    "tracking": {
      "current_release_date": "2024-05-14T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-24-137-02",
      "initial_release_date": "2024-05-14T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-05-14T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV16.41",
                "product": {
                  "name": "CPC80 Central Processing/Communication",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "CPC80 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "CPCI85 Central Processing/Communication",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "CPCI85 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "OPUPI0 AMQP/MQTT",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "OPUPI0 AMQP/MQTT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.3.0",
                "product": {
                  "name": "SICORE Base system",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "SICORE Base system"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected device firmwares contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V16.41 or later version.\n\nThe firmware CPC80 V16.41 is present within \u201cCP-8000/CP-8021/CP-8022 Package\u201d V16.41",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2024-31484"
    },
    {
      "cve": "CVE-2024-31485",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.3.0 or later version\n\nThe firmware SICORE V1.3.0 is present within \"SICAM 8 Software Solution Package\" V5.30",
          "product_ids": [
            "CSAFPID-0004"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        }
      ],
      "title": "CVE-2024-31485"
    },
    {
      "cve": "CVE-2024-31486",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices stores MQTT client passwords without sufficient protection on the devices.  An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware OPUPI0 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2024-31486"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Siemens ProductCERT",
        "summary": "reporting this vulnerability to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SICAM AK3/TM/BC devices are affected by a buffer overflow vulnerability that could allow an attacker to execute code in the context of the current process or lead to a denial of service condition.\n\n- SICAM AK3 device firmware- CPCX26 for CP-2016\n- PCCX26 for CP-2019\n\n\n- SICAM AK3, SICAM BC and SICAM TM device firmware- ETA4 and ETA5 for SM-2558\n\n\n\nSiemens has released new firmware versions for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of these vulnerabilities.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-620338.json"
      },
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
      },
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-620338.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-620338.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-165-09 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-09.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-165-09 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-09"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SICAM AK3/BC/TM",
    "tracking": {
      "current_release_date": "2024-06-11T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-24-165-09",
      "initial_release_date": "2024-06-11T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-06-11T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV06.02",
                "product": {
                  "name": "CPCX26 Central Processing/Communication",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "CPCX26 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV10.46",
                "product": {
                  "name": "ETA4 Ethernet Interface IEC60870-5-104",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "ETA4 Ethernet Interface IEC60870-5-104"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV03.27",
                "product": {
                  "name": "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV06.05",
                "product": {
                  "name": "PCCX26 Ax 1703 PE, Contr, Communication Element",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "PCCX26 Ax 1703 PE, Contr, Communication Element"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V06.02 or later version.\n\nThe firmware CPCX26 V06.02 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V06.05 or later version\n\nThe firmware PCCX26 V06.05 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "CSAFPID-0004"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.46 or later version\n\nThe firmware ETA4 V10.46 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V03.27 or later version\n\nThe firmware ETA5 V03.27 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004"
          ]
        }
      ],
      "title": "CVE-2024-31484"
    }
  ]
}

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-31484"
      ],
      "id": "GSD-2024-31484",
      "modified": "2024-04-11T05:03:20.622959Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-31484",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "SICAM AK3/TM/BC devices are affected by a buffer overflow vulnerability that could allow an attacker to execute code in the context of the current process or lead to a denial of service condition.\n\n- SICAM AK3 device firmware- CPCX26 for CP-2016\n- PCCX26 for CP-2019\n\n\n- SICAM AK3, SICAM BC and SICAM TM device firmware- ETA4 and ETA5 for SM-2558\n\n\n\nSiemens has released new firmware versions for the affected products and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens\u0027 operational guidelines for Industrial Security (Download: \nhttps://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.\nAdditional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
      },
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-620338.json"
      },
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-620338.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-620338.txt"
      }
    ],
    "title": "SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM",
    "tracking": {
      "current_release_date": "2024-06-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-620338",
      "initial_release_date": "2024-06-11T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-11T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV06.02",
                "product": {
                  "name": "CPCX26 Central Processing/Communication",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "CPCX26 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV10.46",
                "product": {
                  "name": "ETA4 Ethernet Interface IEC60870-5-104",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "ETA4 Ethernet Interface IEC60870-5-104"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV03.27",
                "product": {
                  "name": "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV06.05",
                "product": {
                  "name": "PCCX26 Ax 1703 PE, Contr, Communication Element",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "PCCX26 Ax 1703 PE, Contr, Communication Element"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V06.02 or later version.\n\nThe firmware CPCX26 V06.02 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "1"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V06.05 or later version\n\nThe firmware PCCX26 V06.05 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "4"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V10.46 or later version\n\nThe firmware ETA4 V10.46 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V03.27 or later version\n\nThe firmware ETA5 V03.27 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02",
          "product_ids": [
            "3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "title": "CVE-2024-31484"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: \n\n- \nSICAM A8000 device firmwares \n\n- CPC80 for CP-8000/CP-8021/CP-8022 \n- CPCI85 and OPUPI0 for CP-8031/CP-8050\n\n\n- \nSICAM EGS firmware \n\n- CPCI85 and OPUPI0\n\n\n- \nSICAM 8 Software Solution \n\n- SICORE \n\n\n\nSiemens has released new versions for the affected firmwares and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-871704.json"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-871704.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-871704.txt"
      }
    ],
    "title": "SSA-871704: Multiple Vulnerabilities in SICAM Products",
    "tracking": {
      "current_release_date": "2024-06-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-871704",
      "initial_release_date": "2024-05-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-05-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2024-06-11T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added Constantin Schieber-Kn\u00f6bl and Stefan Viehb\u00f6ck to the acknowledgment"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV16.41",
                "product": {
                  "name": "CPC80 Central Processing/Communication",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "CPC80 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "CPCI85 Central Processing/Communication",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "CPCI85 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "OPUPI0 AMQP/MQTT",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "OPUPI0 AMQP/MQTT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.3.0",
                "product": {
                  "name": "SICORE Base system",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SICORE Base system"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V16.41 or later version.\n\nThe firmware CPC80 V16.41 is present within \u201cCP-8000/CP-8021/CP-8022 Package\u201d V16.41",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "title": "CVE-2024-31484"
    },
    {
      "cve": "CVE-2024-31485",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "2",
          "4"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.3.0 or later version\n\nThe firmware SICORE V1.3.0 is present within \"SICAM 8 Software Solution Package\" V5.30",
          "product_ids": [
            "4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "2",
            "4"
          ]
        }
      ],
      "title": "CVE-2024-31485"
    },
    {
      "cve": "CVE-2024-31486",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices stores MQTT client passwords without sufficient protection on the devices.  An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware OPUPI0 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "3"
          ]
        }
      ],
      "title": "CVE-2024-31486"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202405-0174",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "cpci85 central processing/communication",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "v5.30"
      },
      {
        "model": "cpc80 central processing/communication",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "v16.41"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      }
    ]
  },
  "cve": "CVE-2024-31484",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 7.2,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 3.9,
            "id": "CNVD-2024-23525",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "author": "productcert@siemens.com",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "productcert@siemens.com",
            "id": "CVE-2024-31484",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2024-23525",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability has been identified in CPC80 Central Processing/Communication (All versions \u003c V16.41), CPCI85 Central Processing/Communication (All versions \u003c V5.30), CPCX26 Central Processing/Communication (All versions \u003c V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions \u003c V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions \u003c V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions \u003c V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition. SICAM 8 Power automation platform is a universal, all-in-one hardware and software-based solution for all applications in the field of power supply. The SICAM A8000 RTU (Remote Terminal Unit) series is a modular device family for telecontrol and automation applications in all areas of energy supply. SICAM EGS (Enhanced Grid Sensor) is a gateway for local substations in distribution networks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-31484"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      }
    ],
    "trust": 1.44
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "SIEMENS",
        "id": "SSA-871704",
        "trust": 1.6
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31484",
        "trust": 1.6
      },
      {
        "db": "SIEMENS",
        "id": "SSA-620338",
        "trust": 1.0
      },
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525",
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "id": "VAR-202405-0174",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      }
    ]
  },
  "last_update_date": "2024-07-04T22:59:37.352000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Patch for Siemens SICAM products have unspecified vulnerabilities",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchinfo/show/547196"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-170",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.6,
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "trust": 1.0,
        "url": "http://seclists.org/fulldisclosure/2024/jul/4"
      },
      {
        "trust": 1.0,
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-05-24T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      },
      {
        "date": "2024-05-14T16:16:50.260000",
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-05-22T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      },
      {
        "date": "2024-07-04T07:15:10.583000",
        "db": "NVD",
        "id": "CVE-2024-31484"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Siemens SICAM products have unspecified vulnerabilities",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-23525"
      }
    ],
    "trust": 0.6
  }
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-31484"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-170"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T16:16:50Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in CPC80 Central Processing/Communication (All versions \u003c V16.41), CPCI85 Central Processing/Communication (All versions \u003c V5.30). The affected device firmwares contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
  "id": "GHSA-42vc-vfqh-cr2x",
  "modified": "2024-07-04T09:32:48Z",
  "published": "2024-05-14T18:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31484"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Siemens SICAM ist eine Produktfamilie von SCADA-Systemen f\u00fcr den Betrieb von industriellen Prozessen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Siemens SICAM ausnutzen, um beliebigen Programmcode auszuf\u00fchren und um um vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1111 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1111.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1111 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1111"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT vom 2024-05-13",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-620338 vom 2024-06-11",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Siemens SICAM: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-06-11T10:38:07.756+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2024-1111",
      "initial_release_date": "2024-05-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-05-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-06-10T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Siemens aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "CPC80 Central \u003cV16.41",
                "product": {
                  "name": "Siemens SICAM CPC80 Central \u003cV16.41",
                  "product_id": "T034735",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:sicam:cpc80_central_v16.41"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "CPCI85 Central \u003cV5.30",
                "product": {
                  "name": "Siemens SICAM CPCI85 Central \u003cV5.30",
                  "product_id": "T034736",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:sicam:cpci85_central_v5.30"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "OPUPI0 AMQP/MQTT \u003cV5.30",
                "product": {
                  "name": "Siemens SICAM OPUPI0 AMQP/MQTT \u003cV5.30",
                  "product_id": "T034737",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:sicam:opupi0_amqpmqtt_v5.30"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "SICORE Base \u003cV1.3.0",
                "product": {
                  "name": "Siemens SICAM SICORE Base \u003cV1.3.0",
                  "product_id": "T034738",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:sicam:sicore_base_v1.3.0"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "AK3",
                "product": {
                  "name": "Siemens SICAM AK3",
                  "product_id": "T035309",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:sicam:ak3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SICAM"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Siemens SICAM. Dieser Fehler betrifft die CPC80 Central Processing/Communication und die CPCI85 Central Processing/Communication Firmware aufgrund eines fehlerhaften Null-Termination-Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Code im Kontext des aktuellen Prozesses auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035309"
        ]
      },
      "release_date": "2024-05-13T22:00:00Z",
      "title": "CVE-2024-31484"
    },
    {
      "cve": "CVE-2024-31485",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Siemens SICAM. Dieser Fehler betrifft die CPCI85 Central Processing/Communication und die SICORE Base System Firmware aufgrund fehlender Server-seitiger Eingabe\u00fcberpr\u00fcfung, was zu einer Command-Injection-Schwachstelle f\u00fchrt. Ein authentifizierter, privilegierter entfernter Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Code mit Root-Rechten auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035309"
        ]
      },
      "release_date": "2024-05-13T22:00:00Z",
      "title": "CVE-2024-31485"
    },
    {
      "cve": "CVE-2024-31486",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Siemens SICAM. Dieser Fehler betrifft die Firmware OPUPI0 AMQP/MQTT aufgrund eines unzureichenden Schutzmechanismus f\u00fcr MQTT-Client-Passw\u00f6rter. Ein authentifizierter, entfernter Angreifer mit Shell-Zugriff oder physischem Zugriff kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035309"
        ]
      },
      "release_date": "2024-05-13T22:00:00Z",
      "title": "CVE-2024-31486"
    }
  ]
}