PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-52051 Siemens CVE debrief

CVE-2024-52051 is a high-severity local command injection vulnerability affecting 34 Siemens TIA Portal engineering products, including SIMATIC S7-PLCSIM, STEP 7, WinCC, and related components across versions V17-V19. The vulnerability stems from improper sanitization of user-controllable input during user settings parsing, enabling an authenticated local attacker to execute arbitrary OS commands with user privileges. Published December 10, 2024, with advisory updates through December 9, 2025, this vulnerability carries a CVSS 3.1 score of 7.3 (HIGH). The attack vector requires local access with low privileges and user interaction, but successful exploitation yields high impact across confidentiality, integrity, and availability. CISA and Siemens have coordinated disclosure, with patches available for multiple product lines—organizations should prioritize updating STEP 7 Safety V17/V19, WinCC Unified V17, and SIMOTION SCOUT TIA V5.6 to their respective fixed versions, while noting that 23 products remain without available fixes as of the latest advisory revision.

Vendor
Siemens
Product
SIMATIC S7-PLCSIM V17
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2025-12-09
Advisory published
2024-12-10
Advisory updated
2025-12-09

Who should care

Organizations operating Siemens industrial automation environments, particularly those using TIA Portal V17-V19 for PLC programming, HMI development, and drive configuration. Critical infrastructure operators in manufacturing, energy, water, and process industries relying on SIMATIC, SINAMICS, and SIRIUS product lines. Asset owners with engineering workstations accessible to multiple users or connected to broader networks. Security teams responsible for OT/ICS security governance and patch management in environments with extended maintenance windows or legacy version dependencies.

Technical summary

The vulnerability exists in the user settings parsing functionality of affected Siemens engineering products. Insufficient input sanitization allows injection of operating system commands through crafted user settings. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) indicates local attack vector, low attack complexity, low privileges required, user interaction required, and high impacts to confidentiality, integrity, and availability. Exploitation proof-of-concept exists. The affected codebase spans multiple product families within the TIA Portal ecosystem, suggesting shared vulnerable components across the engineering platform.

Defensive priority

high

Recommended defensive actions

  • Apply vendor patches for supported product versions: STEP 7 Safety V17 to Update 9 or later; STEP 7 Safety V19, STEP 7 V19, WinCC Unified PC Runtime V19, WinCC Unified V19, WinCC V19 to Update 4 or later; SIMOTION SCOUT
  • Restrict local access to engineering workstations running affected Siemens TIA Portal products to authorized personnel only
  • Implement application whitelisting and execution controls on hosts running unpatched Siemens engineering software
  • Monitor for anomalous process execution and command-line activity on engineering workstations
  • Review and validate user settings configurations for unexpected modifications
  • Segment engineering networks from operational technology (OT) and enterprise networks per CISA ICS recommended practices
  • For products without available fixes, consider removing from service or isolating in dedicated, access-controlled environments pending vendor update

Evidence notes

Vulnerability description and affected product list derived from CISA CSAF advisory ICSA-24-347-02. CVSS vector and remediation details sourced from Siemens SSA-392859. Timeline information reflects CVE publication date of 2024-12-10 and subsequent advisory updates through 2025-12-09.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-52051 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-52051

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-52051 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-52051

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-347-02.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-392859.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-392859.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-02

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.