CVE-2025-24009 Overview
CVE-2025-24009 is a missing authentication vulnerability affecting Siemens SIRIUS 3RK3 Modular Safety System (MSS) and SIRIUS Safety Relays 3SK2. The affected devices do not require authentication before granting access to critical resources. An attacker with network access can retrieve sensitive information from certain data records, including obfuscated safety passwords. The weakness is classified under [CWE-732] (Incorrect Permission Assignment for Critical Resource). Siemens documented the issue in Siemens Security Advisory SSA-222768.
Critical Impact
Unauthenticated network attackers can extract obfuscated safety passwords from SIRIUS 3RK3 MSS and 3SK2 safety relay devices, undermining the integrity of safety-critical industrial controls.
Affected Products
- Siemens SIRIUS 3RK3 Modular Safety System (MSS) — all versions
- Siemens SIRIUS Safety Relays 3SK2 — all versions
- Deployments using safety password protection on the above devices
Discovery Timeline
- 2025-05-13 - CVE-2025-24009 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24009
Vulnerability Analysis
The SIRIUS 3RK3 MSS and SIRIUS 3SK2 safety relay families implement safety password protection to restrict configuration changes and safety parameter access. The vulnerability stems from the device network interface exposing certain data records without enforcing authentication. A remote attacker with network reachability to the device can request these records and obtain safety passwords in obfuscated form. Because the obfuscation scheme does not provide cryptographic protection, recovered values can be leveraged to influence downstream safety configuration workflows.
The attack requires only network access and no user interaction. The confidentiality impact is high, while integrity and availability of the device are not directly affected by this weakness. Successful information disclosure, however, can enable follow-on attacks against safety logic if the recovered password is reused for programming or diagnostics.
Root Cause
The root cause is incorrect permission assignment on data records containing sensitive material. Access control checks are missing at the protocol layer that serves configuration data. Combined with the use of reversible obfuscation instead of a keyed cryptographic transform, this allows password material to be reconstructed from a passive or lightly active network request.
Attack Vector
Exploitation occurs over the network against the device's engineering or diagnostic interface. The attacker sends crafted requests for specific data records that the firmware serves without authenticating the requester. No credentials, prior access, or user interaction are required. The EPSS score is 0.362% (28.5 percentile), reflecting low observed exploitation activity at the time of writing.
See the Siemens Security Advisory SSA-222768 for the vendor's technical description. No public proof-of-concept code has been verified.
Detection Methods for CVE-2025-24009
Indicators of Compromise
- Unexpected read requests to SIRIUS 3RK3 MSS or 3SK2 devices originating from workstations that are not authorized engineering stations.
- Access to device data records outside of scheduled commissioning or maintenance windows.
- Repeated connection attempts from unmanaged hosts on OT network segments serving safety controllers.
Detection Strategies
- Monitor east-west traffic on OT segments for protocol sessions targeting SIRIUS safety devices from non-engineering hosts.
- Baseline legitimate engineering tool traffic and alert on deviations in source host, timing, or record identifiers requested.
- Correlate device access events with change-management tickets to surface unauthorized reads of configuration records.
Monitoring Recommendations
- Enable and centralize logs from network switches and OT firewalls facing the cell containing the safety controllers.
- Deploy passive OT network monitoring with protocol awareness for Siemens industrial protocols.
- Alert on any device data-record retrieval from hosts that lack an engineering role assignment.
How to Mitigate CVE-2025-24009
Immediate Actions Required
- Restrict network reachability to SIRIUS 3RK3 MSS and 3SK2 devices to authorized engineering stations only, using firewall rules or VLAN segmentation.
- Rotate any safety passwords that may have been exposed on the affected devices.
- Review Siemens Security Advisory SSA-222768 for the latest vendor guidance and firmware availability.
Patch Information
Siemens has not published fixed versions for all affected products in the referenced advisory at time of writing. Consult Siemens Security Advisory SSA-222768 for the current patch status and apply firmware updates as they become available. Until fixes are released, treat the network mitigations below as the primary control.
Workarounds
- Place affected devices behind cell-level firewalls and permit access only from a hardened engineering workstation.
- Follow Siemens' operational guidelines for industrial security, including defense-in-depth and network segmentation per IEC 62443.
- Disable or block device interfaces that are not required for the current operational phase.
- Audit and reduce the number of hosts and users that can reach the safety controller network.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
