CVE-2025-24532
📋 TL;DR
This vulnerability affects Siemens SCALANCE industrial wireless devices with SNMPv3 configured. It allows authenticated users with 'user' role to improperly modify SNMPv3 View configurations, potentially enabling unauthorized access to SNMP data. All listed SCALANCE WAB762-1, WAM763-1, WAM766-1, WUB762-1, and WUM763-1/766-1 devices with versions below V3.0.0 are affected.
💻 Affected Systems
- SCALANCE WAB762-1
- SCALANCE WAM763-1
- SCALANCE WAM763-1 (ME)
- SCALANCE WAM763-1 (US)
- SCALANCE WAM766-1
- SCALANCE WAM766-1 (ME)
- SCALANCE WAM766-1 (US)
- SCALANCE WAM766-1 EEC
- SCALANCE WAM766-1 EEC (ME)
- SCALANCE WAM766-1 EEC (US)
- SCALANCE WUB762-1
- SCALANCE WUB762-1 iFeatures
- SCALANCE WUM763-1
- SCALANCE WUM763-1 (US)
- SCALANCE WUM766-1
- SCALANCE WUM766-1 (ME)
- SCALANCE WUM766-1 (USA)
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
An attacker could reconfigure SNMPv3 views to access sensitive device information, modify configurations, or disrupt industrial network operations through unauthorized SNMP changes.
Likely Case
Unauthorized users could gain access to SNMP data they shouldn't see, potentially exposing network topology, device status, or configuration details.
If Mitigated
With proper network segmentation and SNMP access controls, impact is limited to potential information disclosure within the segmented network.
🎯 Exploit Status
Requires authenticated access with 'user' role. Exploitation involves using SNMPv3 management interfaces to modify view configurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V3.0.0 or later
Vendor Advisory: https://cert-portal.siemens.com/productcert/html/ssa-769027.html
Restart Required: Yes
Instructions:
1. Download firmware V3.0.0 or later from Siemens Industrial Security. 2. Backup current configuration. 3. Upload new firmware via web interface or management tools. 4. Reboot device. 5. Restore configuration if needed. 6. Verify firmware version.
🔧 Temporary Workarounds
Disable SNMPv3
allTemporarily disable SNMPv3 if not required for operations
Access device web interface > SNMP Configuration > Disable SNMPv3
Restrict User Role Access
allLimit 'user' role accounts or elevate required users to admin role
Access device web interface > User Management > Modify user roles
🧯 If You Can't Patch
- Implement network segmentation to isolate affected devices from untrusted networks
- Monitor SNMP configuration changes and audit user access to SNMP management interfaces
🔍 How to Verify
Check if Vulnerable:
Check device firmware version via web interface: System > Device Information. If version is below V3.0.0 and SNMPv3 is enabled with user accounts, device is vulnerable.Check Version:
Via web interface: Navigate to System > Device Information. Via CLI: Use appropriate management tool to query device version.Verify Fix Applied:
After updating, verify firmware version shows V3.0.0 or higher in System > Device Information. Test that user role accounts cannot modify SNMPv3 view configurations.📡 Detection & Monitoring
Log Indicators:
- Unauthorized SNMP configuration changes
- Multiple failed SNMP authentication attempts followed by successful configuration changes
- User role accounts modifying SNMP view settings
Network Indicators:
- Unusual SNMP traffic patterns
- SNMP SET operations from user accounts
SIEM Query:
source="scalance_logs" AND (event="snmp_config_change" OR event="view_type_modification") AND user_role="user"