PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-54015 Siemens CVE debrief

CVE-2024-54015 affects Siemens SIPROTEC 5 devices and related communication modules. The advisory says the devices do not properly validate SNMP GET requests, which can let a remote attacker retrieve sensitive information over SNMPv2. Siemens and CISA recommend restricting access to UDP/161, disabling SNMP if it is not needed, and applying product-specific updates.

Vendor
Siemens
Product
SIPROTEC 5 6MD84 (CP300)
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-02-11
Original CVE updated
2025-08-12
Advisory published
2025-02-11
Advisory updated
2025-08-12

Who should care

OT/ICS operators, substations and grid asset owners, Siemens SIPROTEC 5 administrators, and security teams responsible for network-segmented industrial devices that may expose SNMP on UDP/161.

Technical summary

CISA’s CSAF advisory for CVE-2024-54015 describes a network-reachable information disclosure issue in Siemens SIPROTEC 5 products. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating remote, low-complexity impact focused on confidentiality. The source notes that affected devices do not properly validate SNMP GET requests; an attacker may retrieve sensitive information via SNMPv2 GET requests using default credentials. The advisory lists 48 affected SIPROTEC 5 products and communication modules, with vendor fixes varying by product line.

Defensive priority

High for any exposed instance, especially where SNMP is reachable from untrusted or broadly segmented networks.

Recommended defensive actions

  • Restrict access to UDP/161 to trusted IP addresses only.
  • Disable the SNMP service in the communication modules if it is not required.
  • Apply the Siemens product-specific fixed version for the affected device or module (for example, the advisory lists V9.68, V9.83, V9.90, or V10.0 depending on product line).
  • Inventory SIPROTEC 5 assets and verify which communication modules and version lines are deployed.
  • Review OT network segmentation and monitoring for unnecessary SNMP exposure and unexpected SNMP traffic.

Evidence notes

This debrief is based on the CISA CSAF advisory ICSA-25-044-05 and the linked Siemens product security advisory. The source advisory was published on 2025-02-11 and modified on 2025-08-12, when additional affected products and fixes were added. The source does not list KEV inclusion or known ransomware use.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-54015 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-54015

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-54015 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-54015

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-044-05.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-767615.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-767615.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-05

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.