CVE-2024-54017: SIPROTEC 5 Auth Bypass Vulnerability

CVE-2024-54017 Overview

CVE-2024-54017 affects Siemens SIPROTEC 5 protection relays used in electrical substation automation. The affected devices generate session identifiers using insufficiently random values [CWE-334]. An unauthenticated remote attacker can brute force a valid session identifier on the web server. Successful exploitation grants read access to limited information exposed by the web interface without authorization. The flaw spans dozens of SIPROTEC 5 product variants on CP050, CP100, CP150, CP200, and CP300 communication platforms. Siemens addressed the issue in firmware version V11.0 for supported CP150 and CP300 product lines. The vulnerability is network-exploitable but limited in scope, affecting only confidentiality of a constrained data subset.

Critical Impact

Remote unauthenticated attackers can brute force web session identifiers and gain read access to limited information exposed by affected SIPROTEC 5 devices.

Affected Products

• SIPROTEC 5 CP300 device family (6MD84, 6MD85, 6MD86, 6MD89, 6MU85, 7KE85, 7SA86, 7SA87, 7SD86, 7SD87, 7SJ85, 7SJ86, 7SK85, 7SL86, 7SL87, 7SS85, 7ST85, 7ST86, 7SX85, 7UM85, 7UT85, 7UT86, 7UT87, 7VE85, 7VK87, 7VU85) — all versions prior to V11.0
• SIPROTEC 5 CP150 device family (7SA82, 7SD82, 7SJ81, 7SJ82, 7SK82, 7SL82, 7SX82, 7SY82, 7UT82) — all versions prior to V11.0
• SIPROTEC 5 CP200 device family (6MD85, 6MD86, 7KE85, 7SA84, 7SA86, 7SA87, 7SD84, 7SD86, 7SD87, 7SJ85, 7SJ86, 7SK85, 7SL86, 7SL87, 7SS85, 7ST85, 7UT85, 7UT86, 7UT87, 7VK87) — all versions
• SIPROTEC 5 CP100 devices (7SA82, 7SD82, 7SJ81, 7SJ82, 7SK82, 7SL82, 7UT82) — all versions from V7.80
• SIPROTEC 5 Compact 7SX800 (CP050) — all versions prior to V11.0

Discovery Timeline

• 2026-05-12 - CVE-2024-54017 published to NVD
• 2026-05-12 - Last updated in NVD database

Technical Details for CVE-2024-54017

Vulnerability Analysis

The vulnerability resides in the embedded web server component of SIPROTEC 5 protection relays. The web server issues session identifiers to authenticated users to track their interactions. The generation routine does not draw from a cryptographically secure entropy source. As a result, the produced session tokens occupy a predictable or narrow value space.

An attacker on the same routable network as an affected device can iterate candidate session identifiers against the web server. Because the identifier space is insufficiently random, brute force becomes computationally feasible within practical time. A successful guess allows the attacker to attach to an active session without supplying credentials.

The authorization model on the web interface limits what a hijacked session can access. The impact is therefore restricted to confidentiality of a subset of information rendered through the web server. Integrity and availability of protection functions are not affected by this specific flaw.

Root Cause

The root cause is the use of an insufficiently random value when generating session identifiers, as classified by CWE-334: Small Space of Random Values. When token entropy is too low, the effective keyspace can be enumerated by an attacker.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker reaches the SIPROTEC 5 web server over IP and submits sequential or randomized session identifier values. The attacker only needs to identify when a guessed identifier matches an active session to gain read access. The vulnerability does not enable command execution, configuration changes, or interference with protection logic. Refer to the Siemens Security Advisory SSA-786884 for vendor-confirmed details.

Detection Methods for CVE-2024-54017

Indicators of Compromise

• High volume of HTTP requests to the SIPROTEC 5 web server originating from a single source, particularly with varying session cookie or token values.
• Web server access logs showing sequential or pseudo-random session identifier values that do not correspond to legitimate user logins.
• Successful HTTP 200 responses to session-authenticated endpoints without a preceding authentication request from the same client.

Detection Strategies

• Inspect SIPROTEC 5 web server logs for repeated requests with mismatched or invalid session tokens followed by a successful authenticated response.
• Deploy network-based detection rules that flag rapid HTTP request rates against substation device management interfaces.
• Correlate engineering workstation logins with web server session creation events to identify sessions without a matching authentication source.

Monitoring Recommendations

• Forward SIPROTEC 5 syslog and web server access events into a centralized SIEM for anomaly detection on session establishment patterns.
• Monitor network flows to TCP ports used by the SIPROTEC 5 web interface and alert on connections from outside the engineering management VLAN.
• Track baseline counts of authenticated web sessions per device and alert on deviations.

How to Mitigate CVE-2024-54017

Immediate Actions Required

• Update affected SIPROTEC 5 CP300, CP150, and CP050 devices to firmware version V11.0 or later as published by Siemens.
• Restrict network access to SIPROTEC 5 web server interfaces to authorized engineering workstations only, using firewall ACLs or VLAN segmentation.
• Disable the embedded web server on affected devices where it is not operationally required.
• Place SIPROTEC 5 devices behind a Siemens-recommended security perimeter aligned with IEC 62443 operational technology guidance.

Patch Information

Siemens has released firmware V11.0 for the affected CP300, CP150, and CP050 SIPROTEC 5 product lines. The CP100 and CP200 product variants listed in the advisory have no fix available; Siemens recommends compensating network controls for those platforms. Patch downloads and detailed product mapping are documented in the Siemens Security Advisory SSA-786884.

Workarounds

• Block external access to the SIPROTEC 5 web server by placing devices on isolated control system networks with no direct internet routing.
• Apply defense-in-depth controls following the Siemens operational guidelines for industrial security and IEC 62443 segmentation.
• Limit web interface use to short administrative windows and terminate sessions immediately after configuration tasks.

# Example firewall rule to restrict SIPROTEC 5 web server access
# Replace addresses with the engineering workstation subnet and device IP
iptables -A FORWARD -s 10.10.20.0/24 -d 10.50.1.10 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.50.1.10 -p tcp --dport 443 -j DROP