CVE-2025-24007 Overview
CVE-2025-24007 affects Siemens SIRIUS 3RK3 Modular Safety System (MSS) and SIRIUS Safety Relays 3SK2 across all versions. The devices apply weak obfuscation to the safety password used to guard against inadvertent operating errors. An attacker with network access can retrieve the obfuscated password and reverse it to recover the cleartext value. Recovery of this password allows an adversary to modify safety configurations on industrial control devices used in functional safety applications. The flaw is tracked under CWE-327: Use of a Broken or Risky Cryptographic Algorithm.
Critical Impact
Network-reachable attackers can de-obfuscate the safety password protecting SIRIUS 3RK3 MSS and 3SK2 Safety Relays, enabling unauthorized modification of safety-critical industrial configurations.
Affected Products
- Siemens SIRIUS 3RK3 Modular Safety System (MSS) - All versions
- Siemens SIRIUS Safety Relays 3SK2 - All versions
Discovery Timeline
- 2025-05-13 - CVE-2025-24007 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-24007
Vulnerability Analysis
The vulnerability resides in how the SIRIUS 3RK3 MSS and 3SK2 Safety Relays protect their safety password during transmission and storage. Rather than applying a cryptographic primitive such as a salted hash or authenticated encryption, the devices apply a reversible obfuscation routine. Any party able to observe the obfuscated value can derive the original password by reversing the deterministic transformation. The safety password is intended to prevent inadvertent operating errors on safety-rated logic, so its disclosure undermines a key integrity control in functional safety deployments. Industrial environments often expose these devices on flat OT networks, where engineering workstations and PLCs communicate without additional encryption. The flaw is categorized under CWE-327, covering broken or risky cryptographic algorithms.
Root Cause
The root cause is the use of a reversible obfuscation algorithm in place of a one-way cryptographic function. Obfuscation provides no security guarantee because the algorithm and any keys are embedded in the firmware and client tooling. An attacker with access to either side of the protocol can replicate the de-obfuscation routine.
Attack Vector
Exploitation requires network access to a target device or to traffic carrying the safety password. The attacker captures the obfuscated password during configuration exchanges or extracts it from device memory, then applies the inverse algorithm to recover the cleartext value. No authentication or user interaction is required.
No public proof-of-concept code has been released. Refer to the Siemens Security Advisory SSA-222768 for vendor technical details.
Detection Methods for CVE-2025-24007
Indicators of Compromise
- Unexpected configuration changes or safety password modifications on SIRIUS 3RK3 MSS or 3SK2 devices.
- Engineering tool connections to safety devices originating from unauthorized hosts or subnets.
- Unscheduled firmware or parameter downloads outside maintenance windows.
Detection Strategies
- Capture and inspect engineering protocol traffic to and from safety devices for anomalous read or write operations targeting password-related parameters.
- Correlate access to SIRIUS 3RK3 and 3SK2 devices with authorized maintenance tickets and engineering workstation inventories.
- Alert on new MAC or IP addresses initiating sessions with safety controllers on the OT network.
Monitoring Recommendations
- Deploy passive OT network monitoring to baseline normal communication patterns between engineering stations and safety devices.
- Forward switch and firewall logs from OT segments to a central data lake for retention and retrospective analysis.
- Review device event logs for configuration writes and authentication attempts on a recurring schedule.
How to Mitigate CVE-2025-24007
Immediate Actions Required
- Restrict network reachability of SIRIUS 3RK3 MSS and 3SK2 Safety Relays to authorized engineering hosts only, using firewalls or VLAN segmentation.
- Treat the safety password as compromised on any device that has been exposed to untrusted networks and review recent configuration changes.
- Place safety devices behind a VPN or jump host when remote engineering access is required.
Patch Information
Siemens has published advisory SSA-222768 covering this issue. Consult the advisory for the latest fixed versions and remediation guidance for affected SIRIUS 3RK3 MSS and 3SK2 product lines.
Workarounds
- Apply Siemens operational guidelines for industrial security, including network segmentation and least-privilege access to OT assets.
- Disable or block unused network services on safety devices and adjacent controllers to reduce exposure.
- Limit physical and logical access to engineering workstations that store or transmit the safety password.
# Example: restrict access to SIRIUS safety devices using iptables on an OT gateway
iptables -A FORWARD -s 10.20.30.0/24 -d 10.40.50.10 -p tcp --dport 102 -j ACCEPT
iptables -A FORWARD -d 10.40.50.10 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
