Weak Password Obfuscation in SIRIUS 3RK3 Modular Safety System and Safety Relays 3SK2
CVE-2025-24007

8.7HIGH

Key Information:

Vendor

Siemens
Status
Sirius 3rk3 Modular Safety System (mss)
Sirius Safety Relays 3sk2
Vendor
CVE Published:
13 May 2025

What is CVE-2025-24007?

A significant flaw has been discovered in the SIRIUS 3RK3 Modular Safety System and SIRIUS Safety Relays 3SK2, where inadequate password obfuscation can expose sensitive operational credentials. This vulnerability allows attackers with network access to potentially uncover and de-obfuscate safety passwords, raising concerns about the systems' protection against accidental operational errors. Proper measures should be implemented to enhance password security to mitigate risks associated with unauthorized access.

Affected Version(s)

SIRIUS 3RK3 Modular Safety System (MSS) 0

SIRIUS Safety Relays 3SK2 0

References

https://cert-portal.siemens.com/productcert/html/ssa-2227...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.