Summary
Multiple SICAM products are affected by buffer overflow vulnerability in the IEC 61850 Client libraries from Triangle MicroWorks that could allow an unauthenticated remote attacker to create a denial of service condition by sending specially crafted MMS messages.
Affected SICAM and SITIPE products:
-
SICAM A8000 Device firmware
- ET85 for CP-8000/CP-8021/CP-8022
- ETI5 for CP-8031/CP-8050
-
SICAM EGS Device firmware
- ETI5
-
SICAM S8000
- ETI5
-
SICAM SCC
- SITIPE AT
Siemens has released new versions for the affected products and recommends to update to the latest versions.
Vulnerabilities 1
-
High 8.2
Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing r…
Revision history
-
#4
Added fix version for ET85 Ethernet Interface IEC61850 Ed.2
-
#3
Added fix for SITIPE AT and updated product name of "SICAM 8 Software Solution" to "SICAM S8000"
-
#2
Changed fix version for SICAM SCC from V10.0 to V9.14 HF2, which is now also released; Added ET85 for SICAM A8000 CP-8000/CP-8021/CP-8022 as affected product; Updated CVE data from meanwhile published official source (https://cveawg.mitre.org/api/cve/CVE-2024-34057)
-
#1
Publication Date
References
-
SSA-673996: Buffer Overflow Vulnerability in Third-Party Component in SICAM and SITIPE Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-673996.html