PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-35206 Siemens CVE debrief

A session management vulnerability in Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) allows attackers to obtain unauthorized access due to non-expiring sessions. Published June 11, 2024, this HIGH severity issue (CVSS 7.7) affects industrial network monitoring infrastructure where persistent sessions could enable lateral movement or unauthorized operational control. The vendor has released V1.2 as a remediation.

Vendor
Siemens
Product
SINEC Traffic Analyzer (6GK8822-1BG01-0BA0)
CVSS
HIGH 7.7
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-11
Original CVE updated
2025-05-06
Advisory published
2024-06-11
Advisory updated
2025-05-06

Who should care

Industrial network administrators, OT security teams, and organizations using Siemens SINEC Traffic Analyzer for network monitoring in critical infrastructure environments

Technical summary

The SINEC Traffic Analyzer application fails to implement proper session expiration, allowing authenticated sessions to persist indefinitely. An attacker with local access (AV:L) could leverage a non-expired session to gain unauthorized access without requiring user interaction (UI:N) or privileges (PR:N). The vulnerability enables high-impact confidentiality and integrity compromise (C:H/I:H) though availability is not affected (A:N). The attack complexity is low (AC:L) with unchanged scope (S:U).

Defensive priority

HIGH

Recommended defensive actions

  • Apply vendor fix: Update SINEC Traffic Analyzer to V1.2 or later version per Siemens security advisory
  • Review and enforce session timeout policies across all industrial network management interfaces
  • Implement network segmentation to limit exposure of traffic analyzer systems
  • Monitor for anomalous session persistence or unauthorized access attempts on affected systems
  • Apply defense-in-depth controls per CISA ICS recommended practices for industrial control systems

Evidence notes

CISA CSAF advisory ICSA-24-165-13 identifies the affected product as SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) with CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The advisory was revised February 11, 2025 (CVSS vector update) and May 6, 2025 (typo corrections). Siemens published corresponding advisory SSA-196737. No CISA KEV listing.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-35206 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-35206

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-35206 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-35206

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-13.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-196737.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-196737.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-13

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.