Siemens SENTRON PAC3200 Weak PIN Authentication via Modbus TCP (CVE-2024-41798)

SSA-850560: Use of 4-Digit PIN in SENTRON PAC3200 Devices Key Information from the Webpage: 1. Publication Date: - 2024-10-08 2. Last Update: - 2024-10-08 3. Current Version: - V1.0 4. CVSS v3.1 Base Score: - 9.8 5. CVSS v4.0 Base Score: - 9.3 6. Summary: - SENTRON PAC3200 provides only a 4-digit PIN to protect against administrative access via the Modbus TCP interface. Attackers with access to the Modbus TCP interface could easily bypass this protection through brute-force attacks or by monitoring the cleartext Modbus communication. 7. Affected Products and Solution: - Affected Product and Versions: - SENTRON 7KM PAC3200 - All versions affected by CVE-2024-41798 - Remediation: - No fix is currently planned. - Consider the PIN as protection against unauthorized operation (i.e., protection against inadvertent operational errors), not as protection against malicious access attempts such as brute-force attacks. For further details, refer to the FAQ article at https://support.industry.siemens.com/cs/ww/en/view/109975235/ 8. Workarounds and Mitigations: - Product-specific remediations or mitigations are described in the "Affected Products and Solution" section. - Please follow the General Security Recommendations. 9. General Security Recommendations: - As a general security measure, Siemens strongly recommends protecting network access to devices using appropriate mechanisms. - To operate devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ Operational Guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security) and following the recommendations in the product manuals. - Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity 10. Product Description: 11. Vulnerability Description: - This section describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Where applicable, it also documents the product-specific impact of individual vulnerabilities. 12. Acknowledgments: - Siemens thanks the following party for their efforts: - Michael Messner and Benedikt Kühne from Siemens Energy for reporting the vulnerability 13. Additional Information: - The successor product SENTRON 7KM PAC3220 includes an additional hardware switch that disables administrative write access; only read access is possible remotely. Additionally, enhanced protection against brute-force attacks has been implemented. - For further inquiries regarding security vulnerabilities in Siemens products and solutions, please contact Siemens ProductCERT: https://www.siemens.com/cert/advisories 14. History Data: - V1.0 (2024-10-08): Publication date 15. Terms of Use: - Siemens Security Advisories are subject to the terms and conditions contained in Siemens’ underlying license terms or other applicable agreements previously agreed to with Siemens (hereinafter “License Terms”). To the extent applicable to information, software, or documentation made available in or through a Siemens Security Advisory, the Terms of Use of Siemens’ Global Website (https://www.siemens.com/terms_of_use, hereinafter “Terms of Use”), particularly Sections 8–10 of the Terms of Use, shall apply additionally. In case of conflicts, the License Terms shall prevail over the Terms of Use.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SENTRON PAC3200 Weak PIN Authentication via Modbus TCP (CVE-2024-41798)