PT-2025-28372 · Siemens · Sicam Toolbox Ii

Published 2025-07-08 · Updated 2025-07-08 · CVE-2024-31853

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: SICAM TOOLBOX II versions prior to V07.11

Description: A issue has been identified in the application where it fails to check the extended key usage attribute of a device's certificate when establishing an HTTPS connection to the TLS server of a managed device. This could allow an attacker to execute an on-path network attack, also known as a man-in-the-middle (MitM) attack.

Recommendations: For versions prior to V07.11, update to version V07.11 or later to resolve the issue. As a temporary workaround, consider restricting access to the TLS server of managed devices until the update is applied. Avoid using the affected application to establish HTTPS connections to devices with unverified certificates.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2025-08542

CVE-2024-31853

Affected Products

Sicam Toolbox Ii

References · 5

• https://cert-portal.siemens.com/productcert/html/ssa-183963.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31853 · Security Note
• https://bdu.fstec.ru/vul/2025-08542 · Security Note
• https://osv.dev/vulnerability/CVE-2024-31853 · Vendor Advisory
• https://twitter.com/CVEnew/status/1942535961356951826 · Twitter Post