Security Context Vulnerability in Siemens SCALANCE Devices

CVE-2024-30191

Summary

A vulnerability affects multiple models in the Siemens SCALANCE product line, allowing a physically near attacker to bind an unauthorized security context with network frames meant for legitimate devices. This scenario, identified as Scenario 3 'Override client’s security context' linked to CVE-2022-47522, could enable exploitation through deceptive associations, potentially leading to unauthorized decryption of sensitive frame data. Users of SCALANCE devices are advised to review their configurations and implement appropriate security measures to mitigate this risk.

References