Siemens SENTRON Fuse Vulnerable to Denial-of-Service Attack
A denial-of-service vulnerability in Siemens SENTRON 3NA COM Fuse devices could allow attackers to disrupt operations, requiring network re-establishment for recovery.
Siemens has issued a security advisory detailing a denial-of-service (DoS) vulnerability affecting its SENTRON 3NA COM Fuse devices. The vulnerability, identified as CVE-2024-7322, stems from the improper handling of a network management message. This flaw could enable an attacker to trigger a DoS condition, rendering the device and its associated network segment inoperable.
The exploitation of this vulnerability requires a specific network re-establishment to restore normal operations. This means that once an attack is successful, significant manual intervention may be necessary to bring the affected system back online. The affected versions of the Siemens SENTRON 3NA COM Fuse are those prior to V5.2.
The CVSS v3.1 base score for this vulnerability is 5.8 (MEDIUM), with a vector string of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H. This indicates that while exploitation requires a high level of privilege and is not straightforward (AC:H), the impact on availability (A:H) can be severe. The attack vector is network-based (AV:N), and it can affect the confidentiality and integrity of other components (S:C).
Siemens has addressed this vulnerability by releasing version V5.2 of the SENTRON 3NA COM Fuse, and strongly recommends that users update to this version or a later one. The company also provides general security recommendations, emphasizing the importance of protecting network access to devices with appropriate mechanisms and configuring IT environments according to Siemens' operational guidelines for Industrial Security.
This vulnerability was reported to CISA by Siemens ProductCERT. The advisory highlights that the affected devices are deployed worldwide across critical infrastructure sectors, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities. The potential for widespread disruption underscores the importance of timely patching and robust network security practices.
CISA echoes these recommendations, urging organizations to minimize network exposure for all control system devices, ensure they are not accessible from the internet, and isolate control system networks behind firewalls. When remote access is necessary, secure methods like VPNs should be employed, with the caveat that VPNs themselves must be kept up-to-date.
Organizations experiencing suspected malicious activity related to this vulnerability are encouraged to follow their established internal procedures and report findings to CISA for correlation with other incidents. The advisory serves as a crucial reminder of the ongoing threats to industrial control systems and the necessity of proactive cybersecurity measures.