RADIUS Advisory and the benefits of ProductCERT’s improved formats

Enhancing Siemens Security Advisories: A User-Friendly Approach

In the dynamic world of cybersecurity, Siemens has been on a journey to improve its security advisories. These enhancements aim to benefit both technical and non-technical users. Here are the key milestones of this improvement and their impact.

The Challenge of Identifying Affected Products

When confronted with the RADIUS CVE-2024-3596 vulnerability (addressed in SSA-723487), Siemens faced a difficult task: identifying nearly 500 affected products. The resulting PDF list sprawled across more than 40 pages, filled with often cryptic and similar product names. Clearly, this document was not user-friendly.
For human readers Siemens recommends using HTML view for a better readability of the advisories. For machine parsing Siemens recommends using CSAF (Common Security Advisory Framework).

Balancing Readability and Complexity

Siemens recognizes that as advisories become more intricate, relying solely on human-readable documents (like PDFs) has limitations. While HTML advisories offer significant improvements – especially with the “product grouping” that was introduced recently - the company also encourages users to explore machine-readable formats like CSAF (Common Security Advisory Framework). With product grouping, users can now view a compact HTML advisory showing only the affected product families. For a more detailed view, these families can be expanded into sub-families and individual products, increasing readability significantly.   

Timeline of Improvements in Siemens Advisories

  • April 2022: Introduction of HTML advisories with a similar look and feel to PDF advisories for easy transition. The first in-document link from the “Remediation” column to the corresponding section (reaching back one year to April 2021) was implemented. While not extremely useful, it marked the initial step toward a more interactive data model behind the advisories.
  • January 2023: First appearance of unique MLFB (Siemens Part Number) identifiers in advisories. These identifiers significantly improved the identification of affected products but also increased the advisory’s complexity. 
  • April 2023: Introduction of collapsible chapters in advisories. Readers could now hide sections they weren’t interested in, enhancing overall readability.
  • February 2024: Further in-document links were added from the “Affected Product and Versions” column to the corresponding CVEs. This feature became especially useful as more advisories surfaced where not every product was affected by every vulnerability.
  • February 2024: CVSSv4.0 rating was introduced in parallel to the existing CVSSv3.1 rating.
  • May 2024: The first advisory with Product Specific Vulnerability Description was presented. In this case, one product was affected by the same vulnerability as others but had a different CVSS rating. 
  • July 2024: Product grouping was finally enabled.