PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-37990 Siemens CVE debrief

A medium-severity vulnerability (CVSS 6.5) in Siemens SIMATIC RFID readers allows attackers with privileged access to modify configuration files and enable unreleased features. Published September 10, 2024, this issue affects 27 Siemens SIMATIC RFID reader products including RF610R, RF615R, RF650R, RF680R, RF685R series readers, RF1140R, RF1170R, RF166C, RF185C, RF186C, RF186CI, RF188C, RF188CI, and RF360R models. The vulnerability stems from modifiable configuration files within affected applications that can be altered by privileged attackers to activate features not intended for release on specific devices. Siemens has released firmware updates to address this issue: RF1140R and RF1170R should be updated to V1.1 or later; RF166C, RF185C, RF186C, RF186CI, RF188C, RF188CI, and RF360R should be updated to V2.2 or later; and RF610R, RF615R, RF650R, RF680R, and RF685R series readers should be updated to V4.2 or later. The vulnerability was last modified May 6, 2025, with the revision addressing typo corrections.

Vendor
Siemens
Product
SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0)
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-09-10
Original CVE updated
2025-05-06
Advisory published
2024-09-10
Advisory updated
2025-05-06

Who should care

Organizations using Siemens SIMATIC RFID readers in industrial environments, particularly those in manufacturing, logistics, and supply chain operations where RFID tracking is critical. Security teams responsible for industrial control system (ICS) security and asset management should prioritize firmware updates. System integrators and OT security practitioners managing Siemens SIMATIC product deployments should review access controls and monitor for configuration changes.

Technical summary

The affected Siemens SIMATIC RFID reader applications contain configuration files that can be modified by attackers with privileged access. This allows enabling features that are not released for the specific device. The vulnerability has a CVSS 3.1 score of 6.5 (Medium severity) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, no confidentiality impact, but high integrity and availability impact. The issue affects 27 products across multiple SIMATIC RFID reader families. Siemens has provided specific firmware version updates as remediation: V1.1 or later for RF1140R/RF1170R; V2.2 or later for RF166C, RF185C, RF186C, RF186CI, RF188C, RF188CI, and RF360R; and V4.2 or later for RF610R, RF615R, RF650R, RF680R, and RF685R series readers.

Defensive priority

medium

Recommended defensive actions

  • Apply vendor-provided firmware updates: update RF1140R and RF1170R to V1.1 or later; update RF166C, RF185C, RF186C, RF186CI, RF188C, RF188CI, and RF360R to V2.2 or later; update RF610R, RF615R, RF650R, RF680R, and RF685R
  • Restrict privileged access to affected Siemens SIMATIC RFID reader configuration files to authorized personnel only
  • Monitor for unauthorized configuration changes on affected RFID reader devices
  • Review and implement CISA ICS recommended practices for industrial control system security
  • Segment affected RFID reader networks from untrusted networks to limit attack surface

Evidence notes

CVE published 2024-09-10; modified 2025-05-06. Advisory ICSA-24-256-07 published same date. Affects 27 Siemens SIMATIC RFID reader products. CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-37990 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-37990

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-37990 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-37990

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-256-07.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-765405.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-765405.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-256-07

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.