PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-12133 Siemens CVE debrief

CVE-2024-12133 is a denial-of-service issue tied to libtasn1 certificate handling and documented by CISA in Siemens advisory ICSA-25-162-05. On the affected Siemens SIMATIC S7-1500 CPU family products, specially crafted certificate data with a large number of elements can take much longer than expected to process, which may slow the system or cause a crash. The supplied advisory notes that no fix is currently available.

Vendor
Siemens
Product
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2025-06-10
Original CVE updated
2026-05-14
Advisory published
2025-06-10
Advisory updated
2026-05-14

Who should care

Owners, operators, and maintainers of the affected Siemens SIMATIC S7-1500 CPU 1518/1518F MFP variants, especially OT teams responsible for certificate handling, the additional GNU/Linux subsystem, or any workflows that accept untrusted certificate data.

Technical summary

The issue is described as inefficient handling of specific certificate data in libtasn1, consistent with CWE-407 (inefficient algorithmic complexity). The advisory lists CVSS 3.1 as 5.3/Medium with AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating a network-triggerable availability impact without confidentiality or integrity loss. On the affected Siemens products, a specially crafted certificate can consume excessive processing time and degrade service availability, potentially to the point of crashing the device or subsystem.

Defensive priority

Medium overall, but higher priority for exposed or certificate-processing-dependent Siemens SIMATIC S7-1500 deployments because no fix is available in the supplied advisory and mitigation is limited to exposure reduction.

Recommended defensive actions

  • Restrict access to the interactive shell of the additional GNU/Linux subsystem to trusted personnel only.
  • Only build and run applications from trusted sources.
  • Apply CISA and Siemens industrial-control-system defense-in-depth guidance to reduce exposure to untrusted inputs.
  • Review where affected devices accept or process external certificate data and minimize that exposure until a fix is available.
  • Track Siemens ProductCERT and CISA updates for future remediation guidance or a patched release.

Evidence notes

This debrief is based on the supplied CISA CSAF source item for ICSA-25-162-05 and the referenced Siemens ProductCERT advisory SSA-082556. The CVE was published on 2025-06-10 and last updated on 2026-05-14 in the supplied timeline. The advisory corpus provided here indicates no fix is available and does not include a CISA KEV listing for this CVE.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-12133 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-12133

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-12133 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-12133

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-162-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-082556.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-082556.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.