CVE-2024-37992

Q: What is the severity of CVE-2024-37992?

CVE-2024-37992 has a CVSS score of 4.9 (MEDIUM). This vulnerability affects multiple Siemens SIMATIC RFID reader models where improper SNMP error handling causes application restart when character limits are exceeded. Attackers can trigger denial-of-service conditions by sending specially crafted SNMP requests. Organizations using affected Siemens RFID readers in industrial environments are impacted.

4.9 MEDIUM

Denial of Service

📋 TL;DR

This vulnerability affects multiple Siemens SIMATIC RFID reader models where improper SNMP error handling causes application restart when character limits are exceeded. Attackers can trigger denial-of-service conditions by sending specially crafted SNMP requests. Organizations using affected Siemens RFID readers in industrial environments are impacted.

💻 Affected Systems

Products:

SIMATIC Reader RF610R CMIIT (6GT2811-6BC10-2AA0)
SIMATIC Reader RF610R ETSI (6GT2811-6BC10-0AA0)
SIMATIC Reader RF610R FCC (6GT2811-6BC10-1AA0)
SIMATIC Reader RF615R CMIIT (6GT2811-6CC10-2AA0)
SIMATIC Reader RF615R ETSI (6GT2811-6CC10-0AA0)
SIMATIC Reader RF615R FCC (6GT2811-6CC10-1AA0)
SIMATIC Reader RF650R ARIB (6GT2811-6AB20-4AA0)
SIMATIC Reader RF650R CMIIT (6GT2811-6AB20-2AA0)
SIMATIC Reader RF650R ETSI (6GT2811-6AB20-0AA0)
SIMATIC Reader RF650R FCC (6GT2811-6AB20-1AA0)
SIMATIC Reader RF680R ARIB (6GT2811-6AA10-4AA0)
SIMATIC Reader RF680R CMIIT (6GT2811-6AA10-2AA0)
SIMATIC Reader RF680R ETSI (6GT2811-6AA10-0AA0)
SIMATIC Reader RF680R FCC (6GT2811-6AA10-1AA0)
SIMATIC Reader RF685R ARIB (6GT2811-6CA10-4AA0)
SIMATIC Reader RF685R CMIIT (6GT2811-6CA10-2AA0)
SIMATIC Reader RF685R ETSI (6GT2811-6CA10-0AA0)
SIMATIC Reader RF685R FCC (6GT2811-6CA10-1AA0)
SIMATIC RF1140R (6GT2831-6CB00)
SIMATIC RF1170R (6GT2831-6BB00)
SIMATIC RF166C (6GT2002-0EE20)
SIMATIC RF185C (6GT2002-0JE10)
SIMATIC RF186C (6GT2002-0JE20)
SIMATIC RF186CI (6GT2002-0JE50)
SIMATIC RF188C (6GT2002-0JE40)
SIMATIC RF188CI (6GT2002-0JE60)
SIMATIC RF360R (6GT2801-5BA30)

Versions: All versions below V4.2 for RF6xxR models, below V1.1 for RF11xxR models, below V2.2 for RF1xxC models, below V2.2 for RF360R

Operating Systems: Embedded firmware on Siemens RFID readers

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in default SNMP configuration when character limits are exceeded during SNMP operations.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Repeated exploitation could cause persistent denial-of-service, disrupting RFID operations in industrial settings and potentially affecting production processes.

🟠

Likely Case

Temporary service disruption causing RFID readers to restart, leading to brief interruptions in tag reading operations.

🟢

If Mitigated

Minimal impact with proper network segmentation and SNMP access controls preventing unauthorized access to affected devices.

🌐 Internet-Facing: MEDIUM - Devices exposed to internet could be targeted for DoS attacks, but industrial equipment typically shouldn't be internet-facing.

🏢 Internal Only: MEDIUM - Internal attackers or compromised systems could exploit this to disrupt RFID operations within industrial networks.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires network access to SNMP service on affected devices. No authentication needed to trigger the vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: V4.2 for RF6xxR models, V1.1 for RF11xxR models, V2.2 for RF1xxC models, V2.2 for RF360R

Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-765405.html

Restart Required: Yes

Instructions:

1. Download firmware updates from Siemens Industrial Online Support. 2. Follow Siemens firmware update procedures for specific RFID reader models. 3. Apply firmware update to all affected devices. 4. Verify successful update and functionality.

🔧 Temporary Workarounds

Restrict SNMP Access

all

Limit SNMP access to trusted management systems only using network segmentation and firewall rules.

Disable SNMP if Unused

all

Disable SNMP service on affected devices if not required for operations.

🧯 If You Can't Patch

Implement strict network segmentation to isolate RFID readers from untrusted networks
Deploy network monitoring to detect abnormal SNMP traffic patterns

🔍 How to Verify

Check if Vulnerable:

Check device firmware version via web interface or management software and compare against patched versions listed in advisory.

Check Version:

Use Siemens RFID management software or web interface to check firmware version.

Verify Fix Applied:

Verify firmware version shows V4.2 or higher for RF6xxR models, V1.1 or higher for RF11xxR models, V2.2 or higher for RF1xxC models, V2.2 or higher for RF360R.

📡 Detection & Monitoring

Log Indicators:

Unexpected application restarts on RFID readers
Multiple SNMP requests with long character strings
SNMP error messages related to character limits

Network Indicators:

SNMP traffic to RFID readers with unusually long strings
Multiple SNMP requests from single source in short timeframe

SIEM Query:

source="rfid-reader" AND (event="application_restart" OR event="snmp_error")

📊 Metadata

CVE ID: CVE-2024-37992

CVSS v3 Score: 4.9 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-703

Published: September 10, 2024

Last Updated: September 18, 2024

🔗 References

https://cert-portal.siemens.com/productcert/html/ssa-765405.html Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Simatic Reader Rf610r Cmiit Firmware by Siemens

Simatic Reader Rf610r Etsi Firmware by Siemens

Simatic Reader Rf610r Fcc Firmware by Siemens

Simatic Reader Rf615r Cmiit Firmware by Siemens

Simatic Reader Rf615r Etsi Firmware by Siemens

Simatic Reader Rf615r Fcc Firmware by Siemens

Simatic Reader Rf650r Arib Firmware by Siemens

Simatic Reader Rf650r Cmiit Firmware by Siemens

Simatic Reader Rf650r Etsi Firmware by Siemens

Simatic Reader Rf650r Fcc Firmware by Siemens

Simatic Reader Rf680r Arib Firmware by Siemens

Simatic Reader Rf680r Cmiit Firmware by Siemens

Simatic Reader Rf680r Etsi Firmware by Siemens

Simatic Reader Rf680r Fcc Firmware by Siemens

Simatic Reader Rf685r Arib Firmware by Siemens

Simatic Reader Rf685r Cmiit Firmware by Siemens

Simatic Reader Rf685r Etsi Firmware by Siemens

Simatic Reader Rf685r Fcc Firmware by Siemens

Simatic Rf1140r Firmware by Siemens

Simatic Rf1170r Firmware by Siemens

Simatic Rf166c Firmware by Siemens

Simatic Rf185c Firmware by Siemens

Simatic Rf186c Firmware by Siemens

Simatic Rf186ci Firmware by Siemens

Simatic Rf188c Firmware by Siemens

Simatic Rf188ci Firmware by Siemens

Simatic Rf360r Firmware by Siemens