Improper device certificate validation in Siemens SICAM Toolbox II enables AiTM attacks
Original title: SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication
SEC Consult warns of adversary-in-the-middle attacks due to missing certificate validation in Siemens SICAM Toolbox II device communication; fixed in version 07.11.
SEC Consult Vulnerability Lab issued an advisory on improper device certificate validation in Siemens SICAM Toolbox II device communication. The flaw enables adversary-in-the-middle attacks. Impact is rated high. The fixed version is V07.11.
- Improper device certificate validation allows AiTM attacks
- Affects device communication
- Fixed in V07.11
- CVEs CVE-2024-31853 and CVE-2024-31854
Impact: adversary-in-the-middle attacks on device communication
- Vendors
- Siemens
- Products
- SICAM Toolbox II
- Organizations
- SEC Consult Vulnerability Lab
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-31853+1 related CVE | A vulnerability has been identified in SICAM TOOLBOX II (All versions < V07.11) | 7.7 | <1% |
From the original article
Posted by SEC Consult Vulnerability Lab via Fulldisclosure on Nov 04 SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Improper device certificate validation enables AiTM attacks product: Siemens SICAM Toolbox II device communication vulnerable version: <V07. 11 fixed version: V07.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.