ICSA-25-135-05: Siemens SIPROTEC and SICAM
CISA advisory · released 2025-05-13
Source record Collected from CISA's CSAF advisory feed
- Distribution label in the document: TLP:WHITE
- Revision 5, 2026-07-07 (final)
CISA's summary
Summary: This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials). Further details incl. external references can be found in the chapter "Additional Information". Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information". Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available. See chapter "Additional Information" for details.
Products, as the advisory lists them
| Vendor | Product | Version |
|---|---|---|
| Siemens | CPC80 Central Processing/Communication | vers:intdot/<16.51 |
| Siemens | CPCI85 Central Processing/Communication | vers:intdot/<6.20 |
| Siemens | POWER METER SICAM Q100 family | vers:intdot/<2.70 |
| Siemens | POWER METER SICAM Q200 family | vers:intdot/<2.83 |
| Siemens | Powerlink IP | vers:intdot/<4.22 |
| Siemens | SICAM AK 3 | vers:all/* |
| Siemens | SICAM BC | vers:all/* |
| Siemens | SICAM GridEdge (Classic) | vers:all/* |
| Siemens | SICAM GridEdge Applications for SICAM 8 Platform | vers:all/* |
| Siemens | SICAM GridPass | vers:intdot/<2.50 |
| Siemens | SICAM TM | vers:all/* |
| Siemens | SICORE Base system | vers:intdot/<2.20.0 |
| Siemens | SIPROTEC 5 - CP200 Devices | vers:all/* |
| Siemens | SIPROTEC 5 6MD84 (CP300) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 6MD85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 6MD86 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 6MD89 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 6MD89 (CP300) V9.6x | vers:intdot/<9.68 |
| Siemens | SIPROTEC 5 6MU85 (CP300) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7KE85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SA82 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7SA82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SA86 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SA87 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SD82 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7SD82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SD86 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SD87 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SJ81 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7SJ81 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SJ82 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7SJ82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SJ85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SJ86 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SK82 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7SK82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SK85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SL82 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7SL82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SL86 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SL87 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7SS85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7ST85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7ST85 (CP300) V9.6x | vers:intdot/<9.68 |
| Siemens | SIPROTEC 5 7ST86 (CP300) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7ST86 (CP300) V9.8x | vers:intdot/<9.83 |
| Siemens | SIPROTEC 5 7SX82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SX85 (CP300) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7SY82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7UM85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7UT82 (CP100) | vers:intdot/>=7.80|<8.90 |
| Siemens | SIPROTEC 5 7UT82 (CP150) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 7UT85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7UT86 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7UT87 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7VE85 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7VK87 (CP300) | vers:intdot/>=7.80|<10.0 |
| Siemens | SIPROTEC 5 7VU85 (CP300) | vers:intdot/<10.0 |
| Siemens | SIPROTEC 5 Compact 7SX800 (CP050) | vers:intdot/<10.0 |
DeSpy has not checked any unit, hardware revision or firmware.
Vulnerabilities in this advisory
- CVE-2024-3596 — CVE-2024-3596 · CWE-924
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify responses Access-Reject or Access-Accept using a chosen-prefix collision attack against MD5 Response Authenticator signature.
Acknowledgments, as the advisory lists them
- Siemens ProductCERT: reported this vulnerability to CISA.
The advisory's legal notice
The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.
Sources
DeSpy's copy of this version is dated 2026-09-28.
This product uses the NVD API but is not endorsed or certified by the NVD.
CVE records: Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.
CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
CISA's Known Exploited Vulnerabilities catalog and CISA Vulnrichment data are CC0 1.0. CISA advisories are shown with the TLP label their document carries. No endorsement by CISA, DHS, NIST or MITRE is stated or implied.