PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-48510 Siemens CVE debrief

CVE-2024-48510 is a critical directory traversal vulnerability associated with Siemens SiPass integrated V2.90 and V2.95. According to the advisory, the issue can lead to arbitrary code execution in a restore scenario that uses a specially crafted backup set. Siemens and CISA also note an important constraint: the affected product versions are no longer supported by the maintainer, which narrows the practical exposure but does not reduce the need to remove or replace affected deployments. Fixes are available for both affected branches, and the advisory also recommends limiting restore actions to trusted personnel and avoiding untrusted backup files.

Vendor
Siemens
Product
SiPass integrated V2.90
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-11-13
Original CVE updated
2025-11-13
Advisory published
2025-11-13
Advisory updated
2025-11-13

Who should care

Organizations still running Siemens SiPass integrated V2.90 or V2.95, especially environments that allow configuration restores from backup media. Security, operations, and OT/ICS teams responsible for access-control systems should treat this as a high-priority remediation item.

Technical summary

The advisory describes a directory traversal flaw in DotNetZip v1.16.0 and earlier, referenced through src/Zip.Shared/ZipEntry.Extract.cs. The stated impact is remote arbitrary code execution, with CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. However, the published notes add two key constraints: the affected products are unsupported, and exploitation is only described in the context of restoring a specially crafted backup set. CISA’s CSAF lists Siemens SiPass integrated V2.90 and V2.95 as the affected products and provides vendor fixes for both branches.

Defensive priority

High priority, with immediate action recommended for any remaining affected Siemens SiPass integrated deployments. The combination of critical severity, available vendor fixes, and a restore-path exploitation condition makes version verification and upgrade/removal the most important response.

Recommended defensive actions

  • Upgrade Siemens SiPass integrated V2.90 to V2.90.3.19 or later.
  • Upgrade Siemens SiPass integrated V2.95 to V2.95.3.15 or later.
  • Ensure only trusted persons can initiate a restore via the Configuration Client.
  • Do not use untrusted backup files for restores.
  • Inventory any SiPass integrated installations to confirm whether V2.90 or V2.95 is still in use.
  • Treat unsupported deployments as higher risk and plan migration or replacement if upgrading is not possible.
  • Review restore procedures and backup provenance controls before performing any recovery operation.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-051-04 and the Siemens product security references cited there. The source text explicitly states: the flaw is a directory traversal issue in DotNetZip v1.16.0 and before; it can allow arbitrary code execution via src/Zip.Shared/ZipEntry.Extract.cs; it only affects products that are no longer supported by the maintainer; and exploitation is described only when a specially crafted backup set is used for a restore. The advisory lists Siemens SiPass integrated V2.90 and V2.95 as affected products and includes version-specific fixes.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-48510 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-48510

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-48510 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-48510

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-051-04.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-992434.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-992434.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-051-04

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.