ICSA-25-135-05

icsaUScisa_csaf_ot

Siemens SIPROTEC and SICAM

view advisory published 2025-05-13

This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials). Further details incl. external references can be found in the chapter "Additional Information". Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information". Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter "Additional Information" for details.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2024-3596UScritical9.0OT highExploit
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot…
02

references

External citations — patches, advisories, analysis.

03

remediations (106)

  • MitigationCPC80 Central Processing/Communication

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationCPCI85 Central Processing/Communication

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationPOWER METER SICAM Q100 family

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationPOWER METER SICAM Q200 family

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationPowerlink IP

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSICAM GridPass

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSICORE Base system

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 6MD84 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 6MD85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 6MD86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 6MD89 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 6MD89 (CP300) V9.6x

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 6MU85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7KE85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SA82 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SA82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SA86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SA87 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SD82 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SD82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SD86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SD87 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SJ81 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SJ81 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SJ82 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SJ82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SJ85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SJ86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SK82 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SK82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SK85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SL82 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SL82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SL86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SL87 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SS85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7ST85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7ST85 (CP300) V9.6x

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7ST86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7ST86 (CP300) V9.8x

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SX82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SX85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7SY82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7UM85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7UT82 (CP100)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7UT82 (CP150)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7UT85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7UT86 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7UT87 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7VE85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7VK87 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 7VU85 (CP300)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • MitigationSIPROTEC 5 Compact 7SX800 (CP050)

    Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it

  • FixedCPC80 Central Processing/Communication

    Update to V16.51 or later version

  • FixedCPCI85 Central Processing/Communication

    Update to V6.20 or later version

  • FixedPOWER METER SICAM Q100 family

    Update to V2.70 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109743524/
  • FixedPOWER METER SICAM Q200 family

    Update to V2.83 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109743592/
  • FixedPowerlink IP

    Update to V4.22 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109986527/
  • FixedSICAM GridPass

    Update to V2.50 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109763384/
  • FixedSICORE Base system

    Update to V2.20.0 or later version

  • FixedSIPROTEC 5 6MD84 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 6MD85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 6MD86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 6MD89 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 6MD89 (CP300) V9.6x

    Update to V9.68 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109742950/
  • FixedSIPROTEC 5 6MU85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7KE85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SA82 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7SA82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SA86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SA87 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SD82 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7SD82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SD86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SD87 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SJ81 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7SJ81 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SJ82 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7SJ82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SJ85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SJ86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SK82 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7SK82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SK85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SL82 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7SL82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SL86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SL87 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SS85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7ST85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7ST85 (CP300) V9.6x

    Update to V9.68 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109742950/
  • FixedSIPROTEC 5 7ST86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7ST86 (CP300) V9.8x

    Update to V9.83 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109768428/
  • FixedSIPROTEC 5 7SX82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SX85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7SY82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7UM85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7UT82 (CP100)

    Update to V8.90 or later V8.xx version

  • FixedSIPROTEC 5 7UT82 (CP150)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7UT85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7UT86 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7UT87 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7VE85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7VK87 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 7VU85 (CP300)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
  • FixedSIPROTEC 5 Compact 7SX800 (CP050)

    Update to V10.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109814150/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan