CVE-2024-26306 Siemens CVE debrief

Who should care

Asset owners, OT/ICS defenders, and network administrators responsible for the Siemens SCALANCE products listed in the advisory, especially where RSA-authenticated server-side iPerf3/OpenSSL functionality is enabled or exposed.

Technical summary

The advisory describes a timing side channel in RSA decryption operations triggered when iPerf3 runs as a server with RSA authentication and uses OpenSSL before 3.2.0. The side channel may leak information that can help recover credential plaintext, and the source notes that exploitation requires a large number of decryption messages, consistent with the referenced Marvin/ROBOT-style attack class.

Defensive priority

Medium. Prioritize remediation for any exposed or actively used affected device, and treat systems using RSA authentication as higher priority because the confidentiality impact is high.

Recommended defensive actions

• Update affected Siemens SCALANCE products to V3.0.0 or later, per the vendor remediation.
• Inventory all listed affected SCALANCE model variants and confirm which deployments actually use iPerf3 server functionality with RSA authentication.
• Reduce exposure of affected devices while remediation is planned by limiting network reachability to only trusted management paths.
• Validate whether OpenSSL and iPerf3 versions in the environment are within the affected ranges described in the advisory.
• Follow CISA industrial control system defense-in-depth and recommended-practices guidance when planning containment and remediation.

Evidence notes

The Siemens/CISA advisory lists 19 affected SCALANCE product variants and states the remediation is to update to V3.0.0 or later. The source description says iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations that could enable credential plaintext recovery. The CISA CSAF source was published on 2025-02-11 and revised on 2025-05-06 for typo fixes; no KEV entry is indicated in the supplied timeline.

Official resources