Skip to content
OpenAdvisories
Critical SSA-794185 1 CVE

SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products

Published May 13, 2025 · Updated Oct 13, 2026 · Revision 5

Vendor: Siemens Product: CPC80 Central Processing/Communication Product: CPCI85 Central Processing/Communication Product: POWER METER SICAM Q100 family Product: POWER METER SICAM Q200 family Product: Powerlink IP Product: SICAM AK 3 Product: SICAM BC Product: SICAM GridEdge (Classic) Product: SICAM GridEdge Applications for SICAM 8 Platform Product: SICAM GridPass Product: SICAM TM Product: SICORE Base system Product: SIPROTEC 5 - CP200 Devices Product: SIPROTEC 5 6MD84 (CP300) Product: SIPROTEC 5 6MD85 (CP300) Product: SIPROTEC 5 6MD86 (CP300) Product: SIPROTEC 5 6MD89 (CP300) Product: SIPROTEC 5 6MD89 (CP300) V9.6x Product: SIPROTEC 5 6MU85 (CP300) Product: SIPROTEC 5 7KE85 (CP300) Product: SIPROTEC 5 7SA82 (CP100) Product: SIPROTEC 5 7SA82 (CP150) Product: SIPROTEC 5 7SA86 (CP300) Product: SIPROTEC 5 7SA87 (CP300) Product: SIPROTEC 5 7SD82 (CP100) Product: SIPROTEC 5 7SD82 (CP150) Product: SIPROTEC 5 7SD86 (CP300) Product: SIPROTEC 5 7SD87 (CP300) Product: SIPROTEC 5 7SJ81 (CP100) +30 more

Summary

This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products.

The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials).

Further details incl. external references can be found in the chapter "Additional Information".
Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information".

Siemens has released new versions for the affected products and recommends to update to the latest versions.See chapter "Additional Information" for details.

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine

Revision history

  1. #5

    Corrected fix status for Powerlink IP (full implementation completed)

  2. #4

    Added fix for PowerLink IP

  3. #3

    Added fix for SIPROTEC 5 - CP100 Devices

  4. #2

    Added fix for affected firmware modules in SICAM A8000 (CPCI85 for CP-8031/CP-8050, CPC80 for CP-8000/CP-8021/CP-8022, SICORE for CP-8010/CP-8012), SICAM EGS (CPCI85) and SICAM S8000 (SICORE). Added fix for SICAM Q200, for SIPROTEC 5 - CP300 and CP150 Devices, and for SIPROTEC 5 Compact 7SX800 (CP050). Added SICAM AK 3, SICAM BC, SICAM TM, SICAM GridEdge and SIPROTEC 5 - CP200 Devices to the list of known not affected products

  5. #1

    Publication Date

References