CVE-2024-30172 Siemens CVE debrief

Who should care

Security and operations teams responsible for Siemens SIDIS Prime, especially environments running versions before V4.0.800. Also relevant are application teams and platform owners that embed or depend on Bouncy Castle Java Cryptography APIs, since the underlying issue is in Ed25519 verification logic.

Technical summary

The advisory describes an infinite-loop condition in Ed25519 verification within Bouncy Castle Java Cryptography APIs before 1.78. The trigger is a crafted signature and public key. In the supplied advisory data, Siemens SIDIS Prime is listed as affected for versions before V4.0.800, with remediation to update to V4.0.800 or later. The supplied CVSS vector indicates network attackability, no privileges or user interaction, and high availability impact.

Defensive priority

High. The supplied CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, which makes this a readily reachable denial-of-service style availability risk. Prioritize patching where SIDIS Prime or dependent Bouncy Castle components are deployed and exposed to untrusted inputs.

Recommended defensive actions

• Update Siemens SIDIS Prime to V4.0.800 or later as directed in the advisory.
• Inventory any deployments that include Bouncy Castle Java Cryptography APIs and confirm whether they are below version 1.78.
• Treat Ed25519 verification paths as high-risk input-handling code and monitor for abnormal hangs or stuck worker threads until remediation is complete.
• If immediate patching is not possible, restrict exposure of affected services to trusted network paths and validate that only expected certificates, keys, and signatures are processed.
• Confirm vendor maintenance guidance and any product-specific mitigations from the Siemens advisory before making operational changes.

Evidence notes

Supplied source data identifies CISA advisory ICSA-26-071-03 and Siemens ProductCERT advisory SSA-485750. The description states: 'An issue was discovered in Bouncy Castle Java Cryptography APIs before 1.78. An Ed25519 verification code infinite loop can occur via a crafted signature and public key.' The advisory metadata lists Siemens SIDIS Prime as the affected product with version range 'vers:intdot/<4.0.800' and remediation 'Update to V4.0.800 or later version.' Published and modified dates supplied for the CVE and source item are 2026-03-10 and 2026-03-12T06:00:00Z.

Official resources