Siemens Industrial Products
A Socket.IO vulnerability affects multiple Siemens industrial products. This vulnerability consists of a specially crafted Socket.IO packet that triggers an uncaught exception on the Socket.IO server killing the Node.js process allowing a remote attacker to cause Denial-of-Service condition in the affected products. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-38355US | — | Exploit | ||
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-773256: Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products - CSAF Versionself
- SSA-773256: Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products - HTML Versionself
- ICS Advisory ICSA-24-256-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-256-08 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (12)
- Kein Fix geplantSIMATIC WinCC Runtime Professional V17
Currently no fix is planned
- Kein Fix geplantSIMATIC WinCC V7.4
Currently no fix is planned
- BehobenAI Model Deployer
Update to V1.1 or later version
- BehobenData Flow Monitoring Industrial Edge Device User Interface (DFM IED UI)
Update to V0.0.6 or later version
https://iehub.eu1.edge.siemens.cloud/ - BehobenLiveTwin Industrial Edge app (6AV2170-0BL00-0AA0)
Update to V2.4 or later version
- BehobenSIMATIC PCS neo V4.1
Update to V4.1 Update 2 or later version
- BehobenSIMATIC PCS neo V5.0
Update to V5.0 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109977244/ - BehobenSIMATIC WinCC Runtime Professional V18
Update to V18 Update 5 or later version
- BehobenSIMATIC WinCC Runtime Professional V19
Update to V19 Update 3 or later version
- BehobenSIMATIC WinCC V7.5
Update to V7.5 SP2 Update 18 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793460/ - BehobenSIMATIC WinCC V8.0
Update to V8.0 Update 5 or later version
- BehobenTIA Administrator
Update to V3.0.3 or later version
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan