CVE-2024-54090 Siemens CVE debrief

Who should care

OT/ICS operators, building automation teams, integrators, and maintainers of Siemens APOGEE PXC and TALON TC deployments, especially where BACnet or P2 Ethernet controllers are reachable from management networks or shared administrative accounts are in use.

Technical summary

The source advisory identifies an out-of-bounds read in the memory dump function on affected Siemens devices. The stated impact is that a Medium-privileged or higher attacker could cause an insecure cold start state, which is an operationally significant availability and safety concern in control environments. The advisory does not provide a patch at publication time and instead recommends access and configuration mitigations.

Defensive priority

High for affected deployments, because there is no fix available at publication and the reported condition can push controllers into an insecure cold start state.

Recommended defensive actions

• Change all three default passwords, even if they are not currently in use.
• Disable Telnet where possible; the advisory notes Telnet is disabled by default.
• Inventory affected Siemens APOGEE PXC and TALON TC devices and verify whether any management interfaces are exposed.
• Restrict administrative and engineering access to trusted networks and accounts, following CISA ICS defense-in-depth guidance.
• Monitor for unexpected cold starts, reboots, or other abnormal controller behavior, and confirm recovery procedures are documented.

Evidence notes

Primary evidence comes from CISA's CSAF advisory ICSA-25-044-11 and Siemens advisory SSA-615116, both published on 2025-02-11. The source text states that affected devices contain an out-of-bounds read in the memory dump function and that an attacker with Medium or higher privileges could cause an insecure cold start state. The advisory also lists mitigations and says no fix is currently available. One source detail is internally inconsistent: the description mentions Medium privileges, while the CVSS vector lists PR:N; this debrief preserves both source statements without resolving the discrepancy.

Official resources