PT-2025-10726 · Siemens · Sinamics S200

Published 2025-03-11 · Updated 2025-03-13 · CVE-2024-56336

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SINAMICS S200 versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02

Description A security issue has been identified in the device, where the bootloader is unlocked. This allows attackers to inject malicious code or install untrusted firmware, compromising the intrinsic security features designed to protect against data manipulation and unauthorized access.

Recommendations For SINAMICS S200 versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02, consider securing the bootloader to prevent malicious code injection or untrusted firmware installation. As a temporary workaround, restrict access to the device to minimize the risk of exploitation.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2025-02718

CVE-2024-56336

Affected Products

Sinamics S200

References · 13

• https://bdu.fstec.ru/vul/2025-02718 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-56336 · Security Note
• https://t.me/cvedetector/20079 · Telegram Post
• https://cert-portal.siemens.com/productcert/html/ssa-787280.html · Note
• https://twitter.com/CveFindCom/status/1899400773462540760 · Twitter Post
• https://twitter.com/CVEnew/status/1899404050904354831 · Twitter Post
• https://t.me/pentestingnews/57805 · Telegram Post
• https://twitter.com/vulns_space/status/1899408644304785725 · Twitter Post
• https://twitter.com/Dinosn/status/1900021722738258205 · Twitter Post
• https://t.me/cvetracker/18914 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1899999635051364476 · Twitter Post
• https://t.me/purp_sec/367 · Telegram Post
• https://twitter.com/TweetThreatNews/status/1900211631142937068 · Twitter Post