PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-35207 Siemens CVE debrief

A Cross-Site Request Forgery (CSRF) vulnerability exists in the web interface of Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0). An attacker can trick an authenticated victim into clicking a malicious link, enabling arbitrary actions on the device on behalf of the victim user. The vulnerability was disclosed on June 11, 2024, with a CVSS 3.1 score of 7.8 (HIGH). Siemens has released a vendor fix in version 1.2 or later.

Vendor
Siemens
Product
SINEC Traffic Analyzer (6GK8822-1BG01-0BA0)
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2024-06-11
Original CVE updated
2025-05-06
Advisory published
2024-06-11
Advisory updated
2025-05-06

Who should care

Organizations operating Siemens SINEC Traffic Analyzer devices in industrial environments, particularly those with web interfaces exposed to operational networks or administrative workstations. Security teams responsible for OT/ICS infrastructure, network administrators managing industrial Ethernet diagnostics, and compliance officers tracking CVE remediation for critical infrastructure assets should prioritize this patch.

Technical summary

The web interface of Siemens SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) lacks proper CSRF protections, allowing an attacker to craft malicious requests that execute with the privileges of an authenticated victim. The attack requires user interaction (clicking a malicious link) but can result in complete compromise of device confidentiality, integrity, and availability. The CVSS 3.1 vector indicates a local attack vector with high impact across all security dimensions. Siemens has addressed this in version 1.2.

Defensive priority

HIGH

Recommended defensive actions

  • Update Siemens SINEC Traffic Analyzer to version 1.2 or later
  • Implement network segmentation to limit web interface access to authorized administrative hosts only
  • Configure browser security policies to restrict cross-origin requests to the device web interface
  • Enable and review audit logging for administrative actions performed through the web interface
  • Apply defense-in-depth strategies for industrial control systems as recommended by CISA

Evidence notes

The vulnerability description and remediation details are sourced from CISA's CSAF advisory ICSA-24-165-13, which references Siemens' official security advisory SSA-196737. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local attack vector with low attack complexity, no privileges required, but user interaction required, leading to high impact on confidentiality, integrity, and availability.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-35207 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-35207

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-35207 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-35207

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-165-13.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-196737.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-196737.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-165-13

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.