CVE-2024-54017 Cert Portal CVE debrief

Who should care

Asset owners, operators, and integrators of the listed Siemens SIPROTEC 5 protection devices should review exposure, especially if the device web interface is reachable from enterprise, remote-access, or service networks. OT security teams should also assess any compensating controls around segmentation, firewalling, and management-plane access.

Technical summary

The advisory corpus states that affected devices do not use sufficiently random values to create session identifiers. Because the attack is network-based, unauthenticated, and does not require user interaction, a remote attacker with web access could attempt to guess session IDs and obtain limited read access to information from the web server. The supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, and the corpus maps the weakness to CWE-334.

Defensive priority

Medium. The impact is limited to confidentiality, but the issue is remotely reachable and affects a broad set of industrial protection devices; exposed web interfaces should be reviewed promptly.

Recommended defensive actions

• Inventory the affected SIPROTEC 5 models and firmware or version ranges against the Siemens advisory before planning remediation.
• Apply the vendor fix to V11.0 or later where the advisory lists an update path.
• For products listed as having no fix available, restrict or remove web access where possible and use compensating controls such as network segmentation and strict allowlisting.
• Limit exposure of device management and web interfaces to trusted administrative networks only; avoid direct Internet or broadly routed access.
• Review logs and access controls for abnormal web-session activity, repeated authentication attempts, or unexpected access to device information.
• Confirm whether each deployed model actually uses the web interface in your environment, then validate any vendor notes that affect applicability.

Evidence notes

Primary evidence comes from the CISA CSAF advisory ICSA-26-134-13 and the Siemens ProductCERT advisory SSA-786884 referenced in the corpus. The corpus explicitly states that affected devices use insufficiently random session identifiers and that an unauthenticated remote attacker could brute-force a session identifier to gain read access to limited web-server information. The supplied publication date is 2026-05-12, with a CISA republication/update on 2026-05-14.

Official resources