PT-2024-4461 · Siemens · Simatic Cn 4100

Martin Floeck + 1 · Published 2024-05-14 · Updated 2024-05-14 · CVE-2024-32742

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC CN 4100 versions prior to V3.0

Description The issue is related to the absence of an immutable root of trust in the device's firmware, which can be exploited through an unrestricted USB port. This could allow an attacker with local access to the device to gain complete read/write access to the filesystem by potentially booting another operating system.

Recommendations For SIMATIC CN 4100 versions prior to V3.0, update to version V3.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the USB port to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1326

Related Identifiers

BDU:2024-04963

CVE-2024-32742

Affected Products

Simatic Cn 4100

References · 5

• https://osv.dev/vulnerability/CVE-2024-32742 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-273900.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-04963 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-32742 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsa-24-137-06 · Note