CVE-2024-6874 Siemens CVE debrief

Who should care

OT/ICS operators, Siemens network device administrators, vulnerability management teams, and anyone running the affected Siemens products or firmware that embed the impacted libcurl configuration.

Technical summary

The underlying flaw is a stack-based read caused by libcurl’s curl_url_get() punycode conversion path when built with the macidn IDN backend. For an input name exactly 256 bytes long, the conversion routine can fill the caller’s buffer without null-terminating it, allowing adjacent stack data to be read back as part of the output string. The Siemens/CISA advisory identifies affected Siemens products and directs operators to update to V3.3 or later, with later advisory revisions clarifying the impacted scope and that only SINEC OS firmware is affected.

Defensive priority

Low overall severity, but prioritize remediation if the affected Siemens firmware is present in production, exposed management networks, or environments where information disclosure from device memory would be sensitive.

Recommended defensive actions

• Confirm whether any Siemens products in your environment match the advisory’s affected product list and firmware scope.
• Review the advisory revision history to account for the later clarification that only SINEC OS firmware is impacted.
• Apply Siemens’ fixed release: update to V3.3 or later for affected products.
• Inventory where libcurl is used in embedded or appliance firmware and verify whether the macidn IDN backend is present.
• Limit exposure of management interfaces and follow ICS defense-in-depth practices while patching.

Evidence notes

Supported by the Siemens/CISA CSAF advisory for CVE-2024-6874 and its revision history. The advisory text states that curl_url_get() punycode conversion can read outside a stack buffer when built with the macidn backend, and that a 256-byte input can result in a non-null-terminated string that may return stack contents. The CSAF remediation entries specify updating to V3.3 or later for affected product IDs, and the revision history records later updates that added more product families and clarified the affected firmware scope. The supplied CVSS vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N, matching the low severity. No KEV listing is indicated in the supplied data.

Official resources