Siemens has released an advisory detailing critical vulnerabilities affecting multiple products in their SICAM line, specifically the SICAM A8000 devices (including CP-8031 and CP-8050 models), SICAM EGS, and SICAM 8 software solution.
The vulnerabilities, identified as CVE-2024-37998 and CVE-2024-39601, pose significant security risks by allowing unauthorized password resets and firmware downgrades, potentially leading to privilege escalation and system compromise.
The SICAM A8000 devices running firmware versions prior to V5.40 and SICAM 8 solutions before V1.4.0 are particularly susceptible. The company advises immediate firmware updates to V5.40 and V1.4.0 for the respective products to mitigate these vulnerabilities.
They recommend disabling the auto-login feature to prevent unauthorized access and implementing strict network security measures, including the use of firewalls and secure network segmentation, to safeguard against potential exploits.
The advisory underscores the importance of monitoring systems for unusual activities and maintaining up-to-date security patches by suggesting consulting their security advisories and product documentation for detailed guidance on securing the affected devices.
By encouraging users to follow best practices for cybersecurity, such as using strong passwords and regularly reviewing security settings, they encourage users to take necessary precautions.
It emphasizes that failure to address these vulnerabilities could result in unauthorized access, data breaches, and disruption of critical services, particularly in environments where SICAM products are deployed for industrial control systems and infrastructure management.
Siemens remains committed to supporting their customers in addressing these security challenges and encouraging proactive measures to enhance the security posture of their systems.
For comprehensive details and guidance, they direct users to the Siemens ProductCERT webpage, where they provide the latest information on vulnerabilities, mitigation strategies, and security updates.
Through the implementation of this preventative strategy, Siemens intends to guarantee that their products will continue to function securely in spite of the ever-evolving cyber threats.
CVE-2024-37998 allows unauthorized attackers to reset administrative passwords without current password knowledge on affected applications with auto-login enabled.
This unverified password change vulnerability (CWE-620) grants full administrative access, posing a critical risk due to its network-accessible, low-complexity nature and potential for high confidentiality, integrity, and availability impacts.
CVE-2024-39601 describes a vulnerability where affected devices lack proper authentication for critical firmware downgrade functions, enabling remote authenticated or physically accessible unauthenticated attackers to revert devices to vulnerable older firmware versions.
Consequently, this circumvents security measures and leaves devices vulnerable to the possibility of being exploited by known vulnerabilities that were present in earlier firmware.
