TLS Server Certificate Validation Flaw in SICAM TOOLBOX II by Siemens

CVE-2024-31854

What is CVE-2024-31854?

A vulnerability has been discovered in SICAM TOOLBOX II that impacts all versions prior to V07.11. The application's failure to properly validate the TLS server certificate's common name against the expected value could enable an attacker to perform a Man-in-the-Middle (MitM) attack during the establishment of a secure HTTPS connection. This oversight poses a significant risk to the integrity and confidentiality of data transmitted between devices and the application.

References