Skip to content
OpenAdvisories
High ICSA-24-256-16 1 CVE

Siemens Third-Party Component in SICAM and SITIPE Products

Published Sep 10, 2024 · Updated Dec 9, 2025 · Revision 4

Vendor: Siemens Product: ET85 Ethernet Interface IEC61850 Ed.2 Product: ETI5 Ethernet Int. 1x100TX IEC61850 Product: SICAM SCC Product: SITIPE AT

Summary

Multiple SICAM products are affected by buffer overflow vulnerability in the IEC 61850 Client libraries from Triangle MicroWorks that could allow an unauthenticated remote attacker to create a denial of service condition by sending specially crafted MMS messages.

Affected SICAM and SITIPE products:

-
SICAM A8000 Device firmware

- ET85 for CP-8000/CP-8021/CP-8022
- ETI5 for CP-8031/CP-8050

-
SICAM EGS Device firmware

- ETI5

-
SICAM S8000

- ETI5

-
SICAM SCC

- SITIPE AT

Siemens has released new versions for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

  • High 8.2
    CVE-2024-34057

    Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing r…

Revision history

  1. #4

    Added fix version for ET85 Ethernet Interface IEC61850 Ed.2

  2. #3

    Added fix for SITIPE AT and updated product name of "SICAM 8 Software Solution" to "SICAM S8000"

  3. #2

    Changed fix version for SICAM SCC from V10.0 to V9.14 HF2, which is now also released; Added ET85 for SICAM A8000 CP-8000/CP-8021/CP-8022 as affected product; Updated CVE data from meanwhile published official source (https://cveawg.mitre.org/api/cve/CVE-2024-34057)

  4. #1

    Publication Date

References