Junglewise Threat Intelligence

CVE-2024-54017: Siemens SIPROTEC 5 insufficient randomness in session identifiers

CVE-2024-54017 · Severity: high · CVSS 5.3 · Published 2026-05-12

Technologies: Siemens SIPROTEC 5 7SJ81 (CP100), Siemens SIPROTEC 5 7SD87 (CP200), Siemens SIPROTEC 5 7ST85 (CP300), Siemens SIPROTEC 5 7SY82 (CP150), Siemens SIPROTEC 5 7SD86 (CP200), Siemens SIPROTEC 5 7SL87 (CP300), Siemens SIPROTEC 5 6MD85 (CP300), Siemens SIPROTEC 5 7SD87 (CP300), Siemens SIPROTEC 5 7SJ82 (CP100), Siemens SIPROTEC 5 7SX82 (CP150), Siemens SIPROTEC 5 7SJ82 (CP150), Siemens SIPROTEC 5 7SA87 (CP300), Siemens SIPROTEC 5 7KE85 (CP200), Siemens SIPROTEC 5 7UT82 (CP100), Siemens SIPROTEC 5 7UM85 (CP300), Siemens SIPROTEC 5 7SD86 (CP300), Siemens SIPROTEC 5 6MD85 (CP200), Siemens SIPROTEC 5 7SL86 (CP300), Siemens SIPROTEC 5 7SA87 (CP200), Siemens SIPROTEC 5 7SJ86 (CP300), Siemens SIPROTEC 5 6MU85 (CP300), Siemens SIPROTEC 5 6MD86 (CP300), Siemens SIPROTEC 5 6MD89 (CP300), Siemens SIPROTEC 5 7SK82 (CP150), Siemens SIPROTEC 5 7SA82 (CP100), Siemens SIPROTEC 5 7SK82 (CP100), Siemens SIPROTEC 5 7SL82 (CP100), Siemens SIPROTEC 5 7SJ85 (CP300), Siemens SIPROTEC 5 6MD84 (CP300), Siemens SIPROTEC 5 7SD82 (CP100), Siemens SIPROTEC 5 7SK85 (CP300), Siemens SIPROTEC 5 7SJ81 (CP150), Siemens SIPROTEC 5 7ST86 (CP300), Siemens SIPROTEC 5 7KE85 (CP300), Siemens SIPROTEC 5 7SS85 (CP300), Siemens SIPROTEC 5 6MD86 (CP200), Siemens SIPROTEC 5 7SA86 (CP200), Siemens SIPROTEC 5 7UT82 (CP150), Siemens SIPROTEC 5 7SD82 (CP150), Siemens SIPROTEC 5 7SA86 (CP300), Siemens SIPROTEC 5 7SA82 (CP150), Siemens SIPROTEC 5 7SL82 (CP150), Siemens SIPROTEC 5 7SX85 (CP300). Vendors: Siemens.

Executive brief

Siemens SIPROTEC 5 devices, which are used for protection and control in electrical power grids, contain a vulnerability in how they manage user sessions. An attacker could potentially guess a valid session ID and gain unauthorized access to the device's web interface. This could allow an attacker to view sensitive operational information, potentially aiding in further attacks against critical infrastructure.

Technical details

The vulnerability is classified as a 'Small Space of Random Values' (CWE-334) within the session management component of the SIPROTEC 5 web server. Because session identifiers are generated with insufficient entropy, a remote, unauthenticated attacker can perform a brute-force attack to identify and hijack active sessions. Successful exploitation allows the attacker to gain unauthorized read access to limited information from the web server. Siemens has released firmware version 11.0 to address this issue for many affected models; for others, countermeasures and resilient protection schemes are recommended.

Affected products

  • Siemens SIPROTEC 5 6MD84 (CP300) < 11.0
  • Siemens SIPROTEC 5 6MD85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 6MD86 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 6MD89 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 6MU85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7KE85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SA82 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7SA82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SA86 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SA87 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SD82 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7SD82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SD86 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SD87 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SJ81 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7SJ81 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SJ82 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7SJ82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SJ85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SJ86 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SK82 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7SK82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SK85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SL82 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7SL82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SL86 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SL87 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7SS85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7ST85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7ST86 (CP300) < 11.0
  • Siemens SIPROTEC 5 7SX82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7SX85 (CP300) < 11.0
  • Siemens SIPROTEC 5 7SY82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7UM85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7UT82 (CP100) >= 7.80
  • Siemens SIPROTEC 5 7UT82 (CP150) < 11.0
  • Siemens SIPROTEC 5 7UT85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7UT86 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7UT87 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7VE85 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7VK87 (CP300) >= 7.80, < 11.0
  • Siemens SIPROTEC 5 7VU85 (CP300) < 11.0
  • Siemens SIPROTEC 5 Compact 7SX800 (CP050) < 11.0

Timeline

  • 2026-05-14: advisory: CISA Advisory ICSA-26-134-13 published
  • 2026-05-14: disclosed: Vulnerability disclosed by Siemens and CISA

References

Related threats