CVE-2024-31854: Siemens Sicam Toolbox II MitM Vulnerability

CVE-2024-31854 Overview

CVE-2024-31854 affects Siemens SICAM TOOLBOX II, an engineering and configuration tool used to manage substation automation devices. All versions prior to V07.11 fail to validate the common name field of a managed device's TLS certificate when establishing an HTTPS connection. This improper certificate validation weakness [CWE-295] enables an on-path attacker to intercept, decrypt, and manipulate traffic between the toolbox and a managed device. The vulnerability impacts confidentiality, integrity, and availability of communications with industrial control system endpoints. Siemens published advisory SSA-183963 on July 8, 2025, addressing the issue.

Critical Impact

An adjacent attacker on the network path can perform a machine-in-the-middle (MitM) attack against TLS sessions, exposing engineering data and enabling manipulation of substation automation device configurations.

Affected Products

• Siemens SICAM TOOLBOX II — all versions prior to V07.11
• Siemens substation automation engineering workflows that rely on the affected HTTPS client
• Deployments managing SICAM-compatible field devices through the affected toolbox

Discovery Timeline

• 2025-07-08 - CVE-2024-31854 published to NVD
• 2025-08-20 - Last updated in NVD database

Technical Details for CVE-2024-31854

Vulnerability Analysis

The vulnerability resides in the HTTPS client logic of SICAM TOOLBOX II. When the application initiates a TLS handshake with a managed device, it negotiates a secure channel but skips verification that the certificate's common name (CN) matches the expected device identity. As a result, any certificate trusted by the underlying chain — or a forged certificate accepted due to incomplete chain validation — is treated as belonging to the intended endpoint. An attacker positioned between the operator workstation and the substation device can present a substitute certificate and terminate the TLS session locally. The attacker then proxies traffic to the legitimate device while observing or altering payloads in transit. Because SICAM TOOLBOX II is used to configure protection and control devices, intercepted sessions may carry sensitive parameter sets, firmware operations, and authentication material.

Root Cause

The root cause is incomplete TLS peer identity verification, classified under [CWE-295] Improper Certificate Validation. The client establishes a cryptographically valid session but omits the hostname-to-certificate binding check that prevents impersonation.

Attack Vector

Exploitation requires network adjacency to the management traffic path and user interaction by an engineer initiating an HTTPS connection to a managed device. The attacker must position themselves to intercept and respond to TLS handshakes. Successful exploitation does not require credentials. See the Siemens Security Advisory SSA-183963 for vendor technical details.

Detection Methods for CVE-2024-31854

Indicators of Compromise

• Unexpected TLS certificates presented by managed devices, particularly with mismatched or generic common names.
• ARP table anomalies or duplicate MAC entries on the engineering VLAN that indicate traffic redirection.
• Engineering sessions originating from hosts or interfaces that do not match documented workstation inventories.

Detection Strategies

• Capture HTTPS traffic between SICAM TOOLBOX II workstations and managed devices, then compare observed certificate fingerprints against an approved baseline.
• Alert on TLS sessions where the server certificate common name does not match the documented device hostname or IP.
• Monitor for new processes or proxies binding to ports used by SICAM device management on operator workstations.

Monitoring Recommendations

• Enable continuous packet capture on operational technology (OT) engineering segments and retain metadata for certificate fields.
• Forward workstation and network sensor telemetry to a centralized analytics platform for correlation across sessions.
• Track software inventory to confirm that SICAM TOOLBOX II installations are upgraded to V07.11 or later across all engineering hosts.

How to Mitigate CVE-2024-31854

Immediate Actions Required

• Upgrade SICAM TOOLBOX II to V07.11 or later on every engineering workstation that connects to managed devices.
• Restrict the engineering network so that only authorized workstations can reach managed device management interfaces.
• Enforce strict network segmentation between OT engineering VLANs and general corporate or remote-access networks.

Patch Information

Siemens addressed CVE-2024-31854 in SICAM TOOLBOX II V07.11. Administrators should obtain the update through Siemens support channels and follow the remediation steps outlined in Siemens Security Advisory SSA-183963.

Workarounds

• Limit toolbox connections to dedicated, physically protected engineering segments that exclude untrusted hosts.
• Require operators to verify device certificate fingerprints out-of-band before initiating sensitive configuration sessions.
• Disable or block remote access pathways that traverse shared infrastructure between the toolbox and field devices.

# Configuration example
# Verify installed SICAM TOOLBOX II version on Windows engineering host
wmic product where "Name like 'SICAM TOOLBOX II%%'" get Name,Version

# Restrict outbound HTTPS from engineering workstation to known device subnet only
netsh advfirewall firewall add rule name="SICAM_TOOLBOX_HTTPS" ^
  dir=out action=allow protocol=TCP remoteport=443 ^
  remoteip=10.20.30.0/24 program="C:\Program Files\Siemens\SICAM TOOLBOX II\toolbox.exe"