PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-33496 Siemens CVE debrief

CVE-2024-33496 is a medium-severity vulnerability in Siemens SIMATIC RTLS Locating Manager affecting Report Clients. Published on 2024-05-14 and last modified on 2024-06-11, this issue involves improper credential protection that allows an authenticated local attacker to extract credentials and escalate privileges from Manager to Systemadministrator role. The vulnerability affects seven product variants of the SIMATIC RTLS Locating Manager (6GT2780 series). Siemens has released version V3.0.1.1 as a vendor fix, available through Siemens Online Software Delivery (OSD). CISA and Siemens recommend defense-in-depth mitigations including host consolidation, firewall protection, Windows Server hardening, and restricting system access to trusted personnel. This vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.

Vendor
Siemens
Product
SIMATIC RTLS Locating Manager (6GT2780-0DA00)
CVSS
MEDIUM 6.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-05-14
Original CVE updated
2024-06-11
Advisory published
2024-05-14
Advisory updated
2024-06-11

Who should care

Organizations deploying Siemens SIMATIC RTLS Locating Manager for real-time locating systems in industrial environments, particularly those with multi-user administrative access or distributed Report Client installations. Security teams managing Windows Server infrastructure hosting ICS applications should prioritize this update.

Technical summary

The SIMATIC RTLS Locating Manager Report Clients fail to properly protect authentication credentials used for server communication. An attacker with local access and Manager-level privileges can extract these credentials from the client, then reuse them to authenticate as a Systemadministrator. This represents a horizontal-to-vertical privilege escalation path within the RTLS management plane. The attack requires local access (AV:L) and existing low-privileged authentication (PR:L), with no user interaction needed. The vulnerability affects all seven 6GT2780-series product variants. Siemens addressed this in V3.0.1.1 by implementing proper credential protection mechanisms.

Defensive priority

medium

Recommended defensive actions

  • Update SIMATIC RTLS Locating Manager to version V3.0.1.1 or later via Siemens Online Software Delivery (OSD)
  • Install required RTLS Locating Manager components on a single host computer where possible and ensure only trusted persons have access to the system
  • Secure the Windows Server hosting RTLS Locating Manager with a firewall and ensure no ports are accessible from untrusted networks
  • Apply security hardening of the Windows Server per corporate security policies or current hardening guidelines
  • Review and restrict local access to Report Client systems to prevent credential extraction attempts

Evidence notes

Vulnerability description and remediation details sourced from CISA CSAF advisory ICSA-24-137-07. Vendor fix version V3.0.1.1 confirmed in remediation section. CVSS 6.3 (MEDIUM) per source. Seven affected product variants identified in CSAF product tree.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-33496 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-33496

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-33496 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-33496

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-137-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-093430.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-093430.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/pdf/ssa-093430.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/txt/ssa-093430.txt

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-137-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.