Public preview. Built from real public data on November 9, 2026, 5:41 AM UTC.
Securidigm Watch Transportation cyber intel
Home / Items
Vendor advisorySeverity 9.0 criticalExploit likelihood 15%

SSA-794185: RADIUS Protocol Susceptible to Forgery Attacks (CVE-2024-3596) - Impact to SIPROTEC, SICAM and Related Products

SSA-794185 · Siemens · May 13, 2025

Summary

This advisory documents the impact of CVE-2024-3596 (also dubbed "Blastradius"), a vulnerability in the RADIUS protocol, to SIPROTEC, SICAM and related products. The vulnerability could allow on-path attackers, located between a Network Access Server (the RADIUS client, e.g., a SICAM device) and a RADIUS server, to forge Access-Request packets in a way that enables them to modify the corresponding server response packet at will, e.g., turning an "Access-Reject" message into an "Access-Accept". This would cause the Network Access Server to grant the attackers access to the network with the attackers desired authorization (and without the need of knowing or guessing legitimate access credentials). Further details incl. external references can be found in the chapter "Additional Information". Siemens has released new versions for several affected products and recommends to update to the latest versions, and to configure the updated systems as recommended in the chapter "Additional Information". Siemens has released new versions for the affected products and recommends to update to the latest versions.See chapter "Additional Information" for details.

From Siemens (vendor's own words, quoted), quoted as published. Check the source before acting.

What to do

Configure the RADIUS server to require the presence of a Message-Authenticator attribute in all Access-Request packets from RADIUS client devices that support it Restrict access to the networks where RADIUS messages are exchanged (e.g., send RADIUS traffic via management network or a dedicated VLAN) Update to V10.0 or later version Update to V16.51 or later version

Vendor fix or mitigation, quoted from the advisory.

Each CVE in this advisory

CVESeverityKnown exploitedExploit likelihoodWeakness
CVE-2024-35969.0 criticalNo14.9%Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CWE-924)

Severity from the advisory (CVSS), known exploitation from CISA's catalog, exploit likelihood from EPSS (next 30 days).

Affected products

VendorProductAffected versionsFixed
SiemensCPC80 Central Processing/Communicationvers:intdot/<16.51—
SiemensCPCI85 Central Processing/Communicationvers:intdot/<6.20—
SiemensPOWER METER SICAM Q100 familyvers:intdot/<2.70—
SiemensPOWER METER SICAM Q200 familyvers:intdot/<2.83—
SiemensPowerlink IPvers:intdot/<4.23—
SiemensSICAM AK 3——
SiemensSICAM BC——
SiemensSICAM GridEdge (Classic)——
SiemensSICAM GridEdge Applications for SICAM 8 Platform——
SiemensSICAM GridPassvers:intdot/<2.50—
SiemensSICAM TM——
SiemensSICORE Base systemvers:intdot/<2.20.0—
SiemensSIPROTEC 5 - CP200 Devices——
SiemensSIPROTEC 5 6MD84 (CP300)vers:intdot/<10.0—
SiemensSIPROTEC 5 6MD85 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 6MD86 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 6MD89 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 6MD89 (CP300) V9.6xvers:intdot/<9.68—
SiemensSIPROTEC 5 6MU85 (CP300)vers:intdot/<10.0—
SiemensSIPROTEC 5 7KE85 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SA82 (CP100)vers:intdot/>=7.80|<8.90—
SiemensSIPROTEC 5 7SA82 (CP150)vers:intdot/<10.0—
SiemensSIPROTEC 5 7SA86 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SA87 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SD82 (CP100)vers:intdot/>=7.80|<8.90—
SiemensSIPROTEC 5 7SD82 (CP150)vers:intdot/<10.0—
SiemensSIPROTEC 5 7SD86 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SD87 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SJ81 (CP100)vers:intdot/>=7.80|<8.90—
SiemensSIPROTEC 5 7SJ81 (CP150)vers:intdot/<10.0—
SiemensSIPROTEC 5 7SJ82 (CP100)vers:intdot/>=7.80|<8.90—
SiemensSIPROTEC 5 7SJ82 (CP150)vers:intdot/<10.0—
SiemensSIPROTEC 5 7SJ85 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SJ86 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SK82 (CP100)vers:intdot/>=7.80|<8.90—
SiemensSIPROTEC 5 7SK82 (CP150)vers:intdot/<10.0—
SiemensSIPROTEC 5 7SK85 (CP300)vers:intdot/>=7.80|<10.0—
SiemensSIPROTEC 5 7SL82 (CP100)vers:intdot/>=7.80|<8.90—
SiemensSIPROTEC 5 7SL82 (CP150)vers:intdot/<10.0—
SiemensSIPROTEC 5 7SL86 (CP300)vers:intdot/>=7.80|<10.0—

19 more in the source.

Why it's on these mode pages

  • Maritime: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Pipeline: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Freight rail: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Passenger rail and transit: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Highway and motor carrier: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
  • Postal and parcel: Vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

  1. May 13, 2025: Publication Date
  2. August 12, 2025: Added fix for affected firmware modules in SICAM A8000 (CPCI85 for CP-8031/CP-8050, CPC80 for CP-8000/CP-8021/CP-8022, SICORE for CP-8010/CP-8012), SICAM EGS (CPCI85) and SICAM S8000 (SICORE). Added fix for SICAM Q200, for SIPROTEC 5 - CP300 and CP150 Devices, and for SIPROTEC 5 Compact 7SX800 (CP050). Added SICAM AK 3, SICAM BC, SICAM TM, SICAM GridEdge and SIPROTEC 5 - CP200 Devices to the list of known not affected products
  3. November 11, 2025: Added fix for SIPROTEC 5 - CP100 Devices
  4. June 9, 2026: Added fix for PowerLink IP
  5. October 13, 2026: Corrected fix status for Powerlink IP (full implementation completed)
  6. November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com