Siemens CPCI85 Central Processing Communication up to 05.29 SPI Bus insufficiently protected credentials

Summaryinfo

A vulnerability has been found in Siemens CPCI85 Central Processing Communication up to 05.29 and classified as problematic. The affected element is an unknown function of the component SPI Bus. Performing a manipulation results in insufficiently protected credentials. This vulnerability is known as CVE-2024-53832. The attack may be carried out on the physical device. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Siemens CPCI85 Central Processing Communication up to 05.29. This affects an unknown part of the component SPI Bus. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality. The summary by CVE is:

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files.

It is possible to read the advisory at cert-portal.siemens.com. This vulnerability is uniquely identified as CVE-2024-53832 since 11/22/2024. The exploitability is told to be easy. Attacking locally is a requirement. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1552 according to MITRE ATT&CK.

Upgrading to version 05.30 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Siemens

Name

• CPCI85 Central Processing Communication

Version

• 05.0
• 05.1
• 05.2
• 05.3
• 05.4
• 05.5
• 05.6
• 05.7
• 05.8
• 05.9
• 05.10
• 05.11
• 05.12
• 05.13
• 05.14
• 05.15
• 05.16
• 05.17
• 05.18
• 05.19
• 05.20
• 05.21
• 05.22
• 05.23
• 05.24
• 05.25
• 05.26
• 05.27
• 05.28
• 05.29

License

• commercial

Website

• Vendor: https://www.siemens.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion