Siemens SIPROTEC and SICAM
This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials). Further details incl. external references can be found in the chapter "Additional Information". Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information". Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter "Additional Information" for details.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-3596US | critical9.0OT hoch | Exploit | ||
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any ot… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products - CSAF Versionself
- SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products - HTML Versionself
- ICS Advisory ICSA-25-135-05 JSONself
- ICS Advisory ICSA-25-135-05 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (106)
- MitigationCPC80 Central Processing/Communication
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationCPCI85 Central Processing/Communication
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationPOWER METER SICAM Q100 family
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationPOWER METER SICAM Q200 family
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationPowerlink IP
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSICAM GridPass
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSICORE Base system
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 6MD84 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 6MD85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 6MD86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 6MD89 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 6MD89 (CP300) V9.6x
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 6MU85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7KE85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SA82 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SA82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SA86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SA87 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SD82 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SD82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SD86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SD87 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SJ81 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SJ81 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SJ82 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SJ82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SJ85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SJ86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SK82 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SK82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SK85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SL82 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SL82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SL86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SL87 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SS85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7ST85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7ST85 (CP300) V9.6x
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7ST86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7ST86 (CP300) V9.8x
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SX82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SX85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7SY82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7UM85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7UT82 (CP100)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7UT82 (CP150)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7UT85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7UT86 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7UT87 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7VE85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7VK87 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 7VU85 (CP300)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- MitigationSIPROTEC 5 Compact 7SX800 (CP050)
Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it
- BehobenCPC80 Central Processing/Communication
Update to V16.51 or later version
- BehobenCPCI85 Central Processing/Communication
Update to V6.20 or later version
- BehobenPOWER METER SICAM Q100 family
Update to V2.70 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743524/ - BehobenPOWER METER SICAM Q200 family
Update to V2.83 or later version
https://support.industry.siemens.com/cs/ww/en/view/109743592/ - BehobenPowerlink IP
Update to V4.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109986527/ - BehobenSICAM GridPass
Update to V2.50 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763384/ - BehobenSICORE Base system
Update to V2.20.0 or later version
- BehobenSIPROTEC 5 6MD84 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 6MD85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 6MD86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 6MD89 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 6MD89 (CP300) V9.6x
Update to V9.68 or later version
https://support.industry.siemens.com/cs/ww/en/view/109742950/ - BehobenSIPROTEC 5 6MU85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7KE85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SA82 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7SA82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SA86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SA87 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SD82 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7SD82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SD86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SD87 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SJ81 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7SJ81 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SJ82 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7SJ82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SJ85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SJ86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SK82 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7SK82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SK85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SL82 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7SL82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SL86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SL87 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SS85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7ST85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7ST85 (CP300) V9.6x
Update to V9.68 or later version
https://support.industry.siemens.com/cs/ww/en/view/109742950/ - BehobenSIPROTEC 5 7ST86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7ST86 (CP300) V9.8x
Update to V9.83 or later version
https://support.industry.siemens.com/cs/ww/en/view/109768428/ - BehobenSIPROTEC 5 7SX82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SX85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7SY82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7UM85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7UT82 (CP100)
Update to V8.90 or later V8.xx version
- BehobenSIPROTEC 5 7UT82 (CP150)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7UT85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7UT86 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7UT87 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7VE85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7VK87 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 7VU85 (CP300)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/ - BehobenSIPROTEC 5 Compact 7SX800 (CP050)
Update to V10.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109814150/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan