CVE-2024-39601 — Siemens / CPCI85 Central Processing/Communication

Description (CNA)

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities.

Affected (CNA)

Vendor / product	Versions
Siemens / CPCI85 Central Processing/Communication	affected 0 before V5.40
Siemens / SICORE Base system	affected 0 before V1.4.0

CWE

CWE-306

References

https://cert-portal.siemens.com/productcert/html/ssa-071402.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://cert-portal.siemens.com/productcert/html/ssa-071402.html
http://seclists.org/fulldisclosure/2025/Feb/19