CVE-2025-24510 Siemens CVE debrief

Who should care

OT and building automation operators, Siemens customers, and ICS administrators running MS/TP Point Pickup Module devices on BACnet MSTP networks should pay attention, especially where network access is broad or insufficiently segmented.

Technical summary

The advisory describes a network-reachable availability issue in Siemens MS/TP Point Pickup Module devices. The CVSS vector is AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating no privileges or user interaction are needed, but the attacker must already be on the same BACnet network. A specially crafted BACnet MSTP message can trigger a denial of service that persists until the device is power cycled. The remediation section states that no fix is currently planned.

Defensive priority

Medium overall, with higher priority in exposed or weakly segmented building automation environments because the impact is a device-level outage and recovery requires a power cycle.

Recommended defensive actions

• Inventory Siemens MS/TP Point Pickup Module deployments and confirm where the affected devices are connected.
• Restrict BACnet network access to trusted OT hosts and segment MS/TP traffic from general-purpose IT networks.
• Apply ACLs, filtering, or other compensating controls to limit who can send BACnet MSTP traffic to the device.
• Monitor for unexpected BACnet MSTP traffic, repeated device faults, or unexplained service interruptions.
• Prepare operational recovery procedures for safe power cycling, since that is required to restore normal operation.
• Track Siemens and CISA advisories for any future update or mitigation guidance, noting that the advisory currently lists no fix planned.

Evidence notes

The primary evidence is the CISA CSAF advisory ICSA-25-135-16 and Siemens advisory references, all published on 2025-05-13. The source description states that affected devices improperly handle specific incoming BACnet MSTP messages, that an attacker must already be on the same BACnet network, that the result is denial of service, and that a power cycle is required to restore operation. The remediation entry says 'Currently no fix is planned.'

Official resources