CVE-2024-50557

Q: How do I fix CVE-2024-50557?

1. Download firmware V8.2 from Siemens support portal. 2. Backup current configuration. 3. Upload and install firmware update via web interface or CLI. 4. Reboot device. 5. Verify firmware version is V8.2 or higher.

Q: What is the severity of CVE-2024-50557?

CVE-2024-50557 has a CVSS score of 7.2 (HIGH). This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected Siemens industrial routers by exploiting improper input validation in the iperf functionality. It affects multiple RUGGEDCOM and SCALANCE router models running firmware versions below V8.2. The vulnerability is particularly concerning as it requires no authentication and could lead to complete device compromise.

7.2 HIGH

Remote Code Execution

📋 TL;DR

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected Siemens industrial routers by exploiting improper input validation in the iperf functionality. It affects multiple RUGGEDCOM and SCALANCE router models running firmware versions below V8.2. The vulnerability is particularly concerning as it requires no authentication and could lead to complete device compromise.

💻 Affected Systems

Products:

RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2)
RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2)
SCALANCE M804PB (6GK5804-0AP00-2AA2)
SCALANCE M812-1 ADSL-Router (6GK5812-1AA00-2AA2)
SCALANCE M812-1 ADSL-Router (6GK5812-1BA00-2AA2)
SCALANCE M816-1 ADSL-Router (6GK5816-1AA00-2AA2)
SCALANCE M816-1 ADSL-Router (6GK5816-1BA00-2AA2)
SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2)
SCALANCE M874-2 (6GK5874-2AA00-2AA2)
SCALANCE M874-3 (6GK5874-3AA00-2AA2)
SCALANCE M874-3 3G-Router (CN) (6GK5874-3AA00-2FA2)
SCALANCE M876-3 (6GK5876-3AA02-2BA2)
SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2)
SCALANCE M876-4 (6GK5876-4AA10-2BA2)
SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2)
SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2)
SCALANCE MUM853-1 (A1) (6GK5853-2EA10-2AA1)
SCALANCE MUM853-1 (B1) (6GK5853-2EA10-2BA1)
SCALANCE MUM853-1 (EU) (6GK5853-2EA00-2DA1)
SCALANCE MUM856-1 (A1) (6GK5856-2EA10-3AA1)
SCALANCE MUM856-1 (B1) (6GK5856-2EA10-3BA1)
SCALANCE MUM856-1 (CN) (6GK5856-2EA00-3FA1)
SCALANCE MUM856-1 (EU) (6GK5856-2EA00-3DA1)
SCALANCE MUM856-1 (RoW) (6GK5856-2EA00-3AA1)
SCALANCE S615 EEC LAN-Router (6GK5615-0AA01-2AA2)
SCALANCE S615 LAN-Router (6GK5615-0AA00-2AA2)

Versions: All versions < V8.2

Operating Systems: Siemens proprietary firmware

Default Config Vulnerable: ⚠️ Yes

Notes: All affected devices with iperf functionality enabled are vulnerable by default configuration.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete device takeover allowing attacker to modify configurations, intercept network traffic, pivot to other systems, or disrupt industrial operations.

🟠

Likely Case

Remote code execution leading to device compromise, data exfiltration, or use as a foothold for lateral movement in industrial networks.

🟢

If Mitigated

Limited impact if devices are behind firewalls with strict network segmentation and access controls.

🌐 Internet-Facing: HIGH - Unauthenticated remote exploitation makes internet-facing devices extremely vulnerable.

🏢 Internal Only: HIGH - Even internally, unauthenticated exploitation poses significant risk to industrial control systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability requires no authentication and exploits improper input validation, suggesting relatively straightforward exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: V8.2

Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-354112.html

Restart Required: Yes

Instructions:

1. Download firmware V8.2 from Siemens support portal. 2. Backup current configuration. 3. Upload and install firmware update via web interface or CLI. 4. Reboot device. 5. Verify firmware version is V8.2 or higher.

🔧 Temporary Workarounds

Disable iperf functionality

all

Disable the iperf service if not required for operations

Configure via web interface: System > Services > Disable iperf
CLI: configure terminal > no service iperf

Network segmentation

all

Restrict access to affected devices using firewall rules

Firewall rule to block external access to device management interfaces
Implement network segmentation to isolate industrial devices

🧯 If You Can't Patch

Implement strict network access controls to limit exposure
Monitor for suspicious iperf-related network traffic and configuration changes

🔍 How to Verify

Check if Vulnerable:

Check firmware version via web interface (System > Device Information) or CLI (show version). If version is below V8.2, device is vulnerable.

Check Version:

show version

Verify Fix Applied:

Verify firmware version is V8.2 or higher and test iperf functionality with malformed input to confirm validation.

📡 Detection & Monitoring

Log Indicators:

Unexpected iperf service activations
Configuration changes to iperf settings
Failed authentication attempts followed by iperf activity

Network Indicators:

Unusual iperf traffic patterns
Traffic to iperf ports from unexpected sources
Multiple connection attempts to iperf service

SIEM Query:

source="industrial_router" AND (process="iperf" OR service="iperf") AND (event_type="configuration_change" OR event_type="service_start")

📊 Metadata

CVE ID: CVE-2024-50557

CVSS v3 Score: 7.2 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-20

Published: November 12, 2024

Last Updated: November 13, 2024

🔗 References

https://cert-portal.siemens.com/productcert/html/ssa-354112.html Patch,Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Ruggedcom Rm1224 Lte\(4g\) Eu Firmware by Siemens

Ruggedcom Rm1224 Lte\(4g\) Nam Firmware by Siemens

Scalance M804pb Firmware by Siemens

Scalance M812 1 \(annex A\) Firmware by Siemens

Scalance M812 1 \(annex B\) Firmware by Siemens

Scalance M816 1 \(annex A\) Firmware by Siemens

Scalance M816 1 \(annex B\) Firmware by Siemens

Scalance M826 2 Firmware by Siemens

Scalance M874 2 Firmware by Siemens

Scalance M874 3 \(cn\) Firmware by Siemens

Scalance M874 3 Firmware by Siemens

Scalance M876 3 \(rok\) Firmware by Siemens

Scalance M876 3 Firmware by Siemens

Scalance M876 4 \(eu\) Firmware by Siemens

Scalance M876 4 \(nam\) Firmware by Siemens

Scalance M876 4 Firmware by Siemens

Scalance Mum853 1 \(a1\) Firmware by Siemens

Scalance Mum853 1 \(b1\) Firmware by Siemens

Scalance Mum853 1 \(eu\) Firmware by Siemens

Scalance Mum856 1 \(a1\) Firmware by Siemens

Scalance Mum856 1 \(b1\) Firmware by Siemens

Scalance Mum856 1 \(cn\) Firmware by Siemens

Scalance Mum856 1 \(eu\) Firmware by Siemens

Scalance Mum856 1 \(row\) Firmware by Siemens

Scalance S615 Eec Firmware by Siemens

Scalance S615 Firmware by Siemens