What’s Vulnerable › Vulnerabilities

CVE-2024-31484

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-14 · updated 2026-06-17
• Weakness: CWE-170

Description

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Affected products

• Siemens Cpc80 Central Processing/Communication: before 16.41 — fixed in 16.41
• Siemens Cpci85 Central Processing/Communication: before 5.30 — fixed in 5.30

How to fix

Upgrade to a fixed version: Siemens Cpc80 Central Processing/Communication 16.41; Siemens Cpci85 Central Processing/Communication 5.30. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2024/Jul/4
• https://cert-portal.siemens.com/productcert/html/ssa-620338.html
• https://cert-portal.siemens.com/productcert/html/ssa-871704.html
• http://seclists.org/fulldisclosure/2024/Jul/4
• http://seclists.org/fulldisclosure/2024/Nov/18
• https://cert-portal.siemens.com/productcert/html/ssa-620338.html
• https://cert-portal.siemens.com/productcert/html/ssa-871704.html

Get alerted when CVE-2024-31484 or the next vulnerability affects your stack