SSA-673996: Buffer Overflow Vulnerability in Third-Party Component in SICAM and SITIPE Products
Multiple SICAM products are affected by buffer overflow vulnerability in the IEC 61850 Client libraries from Triangle MicroWorks that could allow an unauthenticated remote attacker to create a denial of service condition by sending specially crafted MMS messages. Affected SICAM and SITIPE products: - SICAM A8000 Device firmware - ET85 for CP-8000/CP-8021/CP-8022 - ETI5 for CP-8031/CP-8050 - SICAM EGS Device firmware - ETI5 - SICAM S8000 - ETI5 - SICAM SCC - SITIPE AT Siemens has released new versions for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-34057US | high7.5 | — | ||
Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages. The resulting buffer overflow can cause a c… | ||||
references
External citations — patches, advisories, analysis.
remediations (4)
- FixedET85 Ethernet Interface IEC61850 Ed.2
Update to V03.27 or later version The firmware ET85 V3.27 is present within “CP-8000/CP-8021/CP-8022 Package” V16.52
- FixedETI5 Ethernet Int. 1x100TX IEC61850
Update to V05.30 or later version The firmware ETI5 V5.30 is present within “CP-8031/CP-8050 Package” V5.30 https://support.industry.siemens.com/cs/ww/en/view/109804985/
- FixedSICAM SCC
Update to V9.14 HF2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109745469/ - FixedSITIPE AT
Update to V3.21 or later version
https://support.industry.siemens.com/cs/ww/en/view/109895930/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan