Skip to content
OpenAdvisories
High SSA-773256 1 CVE

SSA-773256: Impact of Socket.IO CVE-2024-38355 on Siemens Industrial Products

Published Sep 10, 2024 · Updated Jan 14, 2025 · Revision 4

Vendor: Siemens Product: AI Model Deployer Product: Data Flow Monitoring Industrial Edge Device User Interface (DFM IED UI) Product: LiveTwin Industrial Edge app (6AV2170-0BL00-0AA0) Product: SIMATIC PCS neo V4.1 Product: SIMATIC PCS neo V5.0 Product: SIMATIC WinCC Runtime Professional V17 Product: SIMATIC WinCC Runtime Professional V18 Product: SIMATIC WinCC Runtime Professional V19 Product: SIMATIC WinCC V7.4 Product: SIMATIC WinCC V7.5 Product: SIMATIC WinCC V8.0 Product: TIA Administrator

Summary

A Socket.IO vulnerability affects multiple Siemens industrial products. This vulnerability consists of a specially crafted Socket.IO packet that triggers an uncaught exception on the Socket.IO server killing the Node.js process allowing a remote attacker to cause Denial-of-Service condition in the affected products.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available.

Vulnerabilities 1

  • High 7.3
    CVE-2024-38355 Public exploit

    Unhandled 'error' event in socket.io

    Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af2…

    socketio socket.io socket.io npm

Revision history

  1. #4

    Added fix releases for SIMATIC PCS neo V5.0

  2. #3

    Added fix release for WinCC Runtime Professional V19

  3. #2

    Added fix releases for SIMATIC WinCC V8.0, SIMATIC WinCC V7.5, and SIMATIC WinCC Runtime Professional V18

  4. #1

    Publication Date

References