SSA-446545

Siemens Security Advisory by Siemens ProductCERT

SSA-446545: Impact of RegreSSHion (CVE-2024-6387) in Siemens Industrial Products

Publication Date:	2024-09-10
Last Update:	2025-07-08
Current Version:	V1.1
CVSS v3.1 Base Score:	8.1

SUMMARY

An OpenSSH vulnerability, known as regreSSHion, affects multiple Siemens industrial products. This security regression vulnerability consists in a race condition which may allow an unauthenticated remote attacker to achieve remote code execution with high impact on the affected system.

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

KNOWN AFFECTED PRODUCTS

Un-/Collapse All

Affected Product and Versions	Remediation
Industrial Edge Management OS (IEM-OS) All versions affected by CVE-2024-6387	Currently no fix is planned See recommendations from section Workarounds and Mitigations
SINAMICS IIoT module All versions < V1.0 HF1 affected by CVE-2024-6387	Update to V1.0 HF1 or later version https://support.industry.siemens.com/cs/ww/en/view/109989288/ See further recommendations from section Workarounds and Mitigations
SINEMA Remote Connect Server All versions < V3.2 SP2 affected by CVE-2024-6387	Update to V3.2 SP2 or later version https://support.industry.siemens.com/cs/ww/en/view/109974084/ See further recommendations from section Workarounds and Mitigations
SINUMERIK ONE All versions < V6.24 affected by CVE-2024-6387	Update to V6.24 or later version Updated software version can be obtained from Siemens customer support or a local partner. See further recommendations from section Workarounds and Mitigations

WORKAROUNDS AND MITIGATIONS

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

Disable SSH when possible
Limit remote access to the SSH port (default: 22/tcp) to trusted systems only
Change the default SSH port (22/tcp) to a nonstandard port to minimize success of automated attacks

Please follow the General Security Recommendations.

GENERAL SECURITY RECOMMENDATIONS

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

PRODUCT DESCRIPTION

Industrial Edge represents an open, ready-to-use Edge computing platform consisting of Edge devices, Edge apps, Edge connectivity, and an application and device management infrastructure.

SINEMA Remote Connect is a management platform for remote networks that enables the simple management of tunnel connections (VPN) between headquarters, service technicians, and installed machines or plants. It provides both the Remote Connect Server, which is the server application, and the Remote Connect Client, which is an OpenVPN client for optimal connection to SINEMA Remote Connect Server.

SINUMERIK ONE is a digital-native CNC system with an integrated SIMATIC S7-1500 CPU for automation.

VULNERABILITY DESCRIPTION

Un-/Collapse All

This chapter describes all vulnerabilities (CVE-IDs) addressed in this security advisory. Wherever applicable, it also documents the product-specific impact of the individual vulnerabilities.

Vulnerability CVE-2024-6387

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

CVSS v3.1 Base Score	8.1
CVSS v3.1 Vector	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE	CWE-364: Signal Handler Race Condition

ADDITIONAL INFORMATION

For SINUMERIK ONE:

This vulnerability can be triggered on all SINUMERIK interfaces (X120, X127, X130) if the ssh port is open to get root access.
Updated software version can be obtained from Siemens customer support or a local partner.

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT: https://www.siemens.com/cert/advisories

HISTORY DATA

V1.0 (2024-09-10):	Publication Date
V1.1 (2025-07-08):	Added fix for SINAMICS IIoT module

The use of Siemens Security Advisories is subject to the terms and conditions listed on: https://www.siemens.com/productcert/terms-of-use.