Analysis Summary

CVE-2024-37998 CVSS:9.8

Siemens SICAM Products could allow a remote attacker to bypass security restrictions, caused by an unverified password change flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to gain administrative access to the system.

CVE-2024-39601 CVSS:6.5

Siemens SICAM Products could allow a remote authenticated attacker to bypass security restrictions, caused by improper authentication validation. By sending a specially crafted request, an attacker could exploit this vulnerability to to downgrade the firmware on the device.

Impact

• Security Bypass

Indicators of Compromise

CVE

• CVE-2024-37998
• CVE-2024-39601

Affected Vendors

Affected Products

• Siemens CPCI85 Central Processing/Communication
• Siemens SICORE Base system

Remediation

Refer to Siemens Security Advisory for patch, upgrade or suggested workaround information.

Siemens Security Advisory