CVE-2024-56182

March 11, 2025, 10:15 a.m.

8.2
High

Description

A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions < V26.01.12), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543B (All versions), SIMATIC IPC RW-543A (All versions), SIMATIC IPC127E (All versions), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions), SIMATIC IPC277G PRO (All versions), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions), SIMATIC IPC427E (All versions), SIMATIC IPC477E (All versions), SIMATIC IPC477E PRO (All versions), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to disable the BIOS password without proper authorization by directly communicate with the flash controller.

Product(s) Impacted

Vendor Product Versions
Siemens
  • Simatic Field Pg M5
  • Simatic Field Pg M6
  • Simatic Ipc Bx-21a
  • Simatic Ipc Bx-32a
  • Simatic Ipc Bx-39a
  • Simatic Ipc Bx-59a
  • Simatic Ipc Px-32a
  • Simatic Ipc Px-39a
  • Simatic Ipc Rc-543b
  • Simatic Ipc Rw-543a
  • Simatic Ipc127e
  • Simatic Ipc227e
  • Simatic Ipc277e
  • Simatic Ipc3000 Smart V3
  • Simatic Ipc427e
  • Simatic Ipc477e
  • Simatic Ipc527g
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-693
Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a siemens simatic_field_pg_m5 / / / / / / / /
a siemens simatic_field_pg_m6 / / / / / / / /
a siemens simatic_ipc_bx-21a / / / / / / / /
a siemens simatic_ipc_bx-32a / / / / / / / /
a siemens simatic_ipc_bx-39a / / / / / / / /
a siemens simatic_ipc_bx-59a / / / / / / / /
a siemens simatic_ipc_px-32a / / / / / / / /
a siemens simatic_ipc_px-39a / / / / / / / /
a siemens simatic_ipc_rc-543b / / / / / / / /
a siemens simatic_ipc_rw-543a / / / / / / / /
a siemens simatic_ipc127e / / / / / / / /
a siemens simatic_ipc227e / / / / / / / /
a siemens simatic_ipc277e / / / / / / / /
a siemens simatic_ipc3000_smart_v3 / / / / / / / /
a siemens simatic_ipc427e / / / / / / / /
a siemens simatic_ipc477e / / / / / / / /
a siemens simatic_ipc527g / / / / / / / /

References

https://cert-portal.siemens.com/productcert/html/ssa-216014.html

Tags

productcert@siemens.com
CWE-693
2025-03-11
CVE-2024-56182

CVSS Score

8.2 / 10

CVSS Data - 3.1

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: HIGH
  • Scope: CHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH

    • CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

    View Vector String

Timeline

Published: March 11, 2025, 10:15 a.m.
Last Modified: March 11, 2025, 10:15 a.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

productcert@siemens.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.