Siemens Industrial Products
A Socket.IO vulnerability affects multiple Siemens industrial products. This vulnerability consists of a specially crafted Socket.IO packet that triggers an uncaught exception on the Socket.IO server killing the Node.js process allowing a remote attacker to cause Denial-of-Service condition in the affected products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-38355US | — | Exploit | ||
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO… | ||||
references
External citations — patches, advisories, analysis.
- SSA-773256: Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products - CSAF Versionself
- SSA-773256: Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products - HTML Versionself
- ICS Advisory ICSA-24-256-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-256-08 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (12)
- No fix plannedSIMATIC WinCC Runtime Professional V17
Currently no fix is planned
- No fix plannedSIMATIC WinCC V7.4
Currently no fix is planned
- FixedAI Model Deployer
Update to V1.1 or later version
- FixedData Flow Monitoring Industrial Edge Device User Interface (DFM IED UI)
Update to V0.0.6 or later version
https://iehub.eu1.edge.siemens.cloud/ - FixedLiveTwin Industrial Edge app (6AV2170-0BL00-0AA0)
Update to V2.4 or later version
- FixedSIMATIC PCS neo V4.1
Update to V4.1 Update 2 or later version
- FixedSIMATIC PCS neo V5.0
Update to V5.0 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977244/ - FixedSIMATIC WinCC Runtime Professional V18
Update to V18 Update 5 or later version
- FixedSIMATIC WinCC Runtime Professional V19
Update to V19 Update 3 or later version
- FixedSIMATIC WinCC V7.5
Update to V7.5 SP2 Update 18 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - FixedSIMATIC WinCC V8.0
Update to V8.0 Update 5 or later version
- FixedTIA Administrator
Update to V3.0.3 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan