PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-6657 silabs.com CVE debrief

A denial-of-service vulnerability in the Bluetooth Low Energy (BLE) stack of Siemens SENTRON Powercenter devices. Multiple central devices continuously connecting and disconnecting to a single peripheral can render the peripheral unresponsive, requiring a hard reset to recover. The vulnerability was initially reported affecting SENTRON Powercenter 1000 and 1100 models; however, a June 2025 revision to the advisory clarified that SENTRON Powercenter devices are not affected by this vulnerability. Organizations should verify current product security bulletins for accurate affected product information.

Vendor
silabs.com
Product
SENTRON Powercenter 1000 (7KN1110-0MC00)
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-12-10
Original CVE updated
2025-06-10
Advisory published
2024-12-10
Advisory updated
2025-06-10

Who should care

Organizations deploying Siemens SENTRON Powercenter devices with BLE connectivity; industrial control system operators using BLE-enabled field devices; security teams responsible for OT/ICS network availability and incident response.

Technical summary

The vulnerability exists in the BLE protocol stack implementation where a peripheral device becomes unresponsive when subjected to rapid connect/disconnect cycles from multiple central devices. This state persists until a hard reset is performed. The attack vector requires proximity for BLE communication and multiple coordinating or independent central devices. The June 2025 advisory revision indicates the originally listed SENTRON Powercenter products are not affected, suggesting potential initial misidentification or scope correction in the disclosure process.

Defensive priority

medium

Recommended defensive actions

  • Review current Siemens security advisory SSA-620799 for definitive affected product information
  • Verify BLE peripheral device behavior in operational environments for unexpected connection handling
  • Implement network segmentation for BLE-enabled industrial devices where feasible
  • Monitor for anomalous connection patterns from multiple central devices to single peripherals
  • Establish hard reset procedures for affected peripheral devices in incident response plans
  • Subscribe to CISA ICS advisories and Siemens ProductCERT notifications for updates

Evidence notes

CVE published 2024-12-10 per CISA ICS advisory ICSA-24-347-10. Advisory modified 2025-06-10 to clarify that SENTRON Powercenter devices are not affected. Source: CISA CSAF advisory with revision history documenting the clarification.

Sources and references

Verified primary and authoritative sources

  • CVE-2024-6657 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2024-6657

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2024-6657 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2024-6657

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2024/icsa-24-347-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/csaf/ssa-620799.json

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://cert-portal.siemens.com/productcert/html/ssa-620799.html

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-24-347-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.