CVE-2025-24532 Overview
CVE-2025-24532 is an incorrect authorization vulnerability affecting Siemens SCALANCE wireless access points and client modules. Devices with the user role can modify the View Type of Simple Network Management Protocol version 3 (SNMPv3) Views, an operation that should require higher privileges. The flaw is tracked under CWE-284: Improper Access Control and impacts all firmware versions below V3.0.0 across the SCALANCE WAB, WAM, and WUM product families. Siemens documented the issue in Siemens Security Advisory SSA-769027.
Critical Impact
A low-privileged authenticated user can alter SNMPv3 View configurations on affected SCALANCE wireless devices, undermining SNMP-based monitoring integrity.
Affected Products
- SCALANCE WAB762-1 and WUB762-1 wireless access points (all versions prior to V3.0.0)
- SCALANCE WAM763-1 and WAM766-1 wireless access points, including EEC, ME, and US variants (all versions prior to V3.0.0)
- SCALANCE WUM763-1 and WUM766-1 client modules, including ME and US variants (all versions prior to V3.0.0)
Discovery Timeline
- 2025-02-11 - CVE-2025-24532 published to NVD by Siemens ProductCERT
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-24532
Vulnerability Analysis
The vulnerability resides in the SNMPv3 View configuration handler on SCALANCE wireless firmware. SNMPv3 Views define which Management Information Base (MIB) subtrees are included or excluded from an SNMP user's visibility. The View Type field determines whether a subtree is included or excluded from a View, controlling what data SNMP clients can read or write.
On affected devices, the authorization check for modifying the View Type does not enforce administrator-only access. Any account holding the user role can invoke the configuration action and change the View Type value. This breaks the intended privilege boundary between read-only operators and administrators managing SNMP access policy.
The practical consequence is limited integrity impact on the device configuration. An attacker with valid user credentials could hide MIB subtrees from legitimate monitoring or expose subtrees that should be restricted, affecting the reliability of SNMP-driven telemetry and access control decisions.
Root Cause
The root cause is a missing role check in the SNMPv3 View management endpoint. The firmware validates authentication but does not verify that the requesting account holds the administrator role before applying changes to the View Type attribute.
Attack Vector
Exploitation requires network reachability to the device management interface and valid user credentials. No user interaction is required. Once authenticated, the attacker issues an SNMPv3 View configuration change that the firmware accepts and persists.
No public proof-of-concept code is available. See the Siemens Security Advisory SSA-769027 for vendor-provided technical detail.
Detection Methods for CVE-2025-24532
Indicators of Compromise
- Unexpected changes to SNMPv3 View definitions on SCALANCE WAB, WAM, or WUM devices, particularly modifications to the View Type field.
- Configuration change events on the device audit log originating from accounts assigned the user role rather than an administrator account.
- Discrepancies between the SNMPv3 View configuration stored in change management and the running configuration on the device.
Detection Strategies
- Baseline the SNMPv3 View configuration for each affected SCALANCE device and alert on any drift.
- Correlate device authentication logs with configuration change events to flag View Type modifications performed by non-administrator accounts.
- Forward SCALANCE syslog output to a centralized SIEM and build detections for SNMP configuration commands issued outside approved change windows.
Monitoring Recommendations
- Enable and retain administrative audit logs on all SCALANCE wireless devices at firmware V3.0.0 or later.
- Monitor management-plane traffic to SCALANCE devices for authentication attempts using low-privileged accounts followed by configuration write operations.
- Review the list of accounts with the user role quarterly and remove any that no longer require access.
How to Mitigate CVE-2025-24532
Immediate Actions Required
- Inventory all SCALANCE WAB762-1, WAM763-1, WAM766-1, WUB762-1, WUM763-1, and WUM766-1 devices and identify those running firmware below V3.0.0.
- Upgrade affected devices to firmware V3.0.0 or later as published in Siemens Security Advisory SSA-769027.
- Rotate credentials for any accounts assigned the user role on devices that have not yet been patched.
Patch Information
Siemens has released firmware version V3.0.0 for all affected SCALANCE WAB, WAM, and WUM product variants. Apply the vendor-supplied update through the standard SCALANCE firmware update procedure. Refer to Siemens Security Advisory SSA-769027 for firmware download links and device-specific instructions.
Workarounds
- Restrict management-plane access to the SCALANCE devices to a dedicated administrative network segment using firewall rules or VLAN isolation.
- Limit assignment of the user role to trusted operators and audit existing role assignments before patching.
- Where SNMPv3 configuration changes are not required operationally, disable SNMP write access on the device until firmware V3.0.0 is deployed.
# Example firewall rule concept to restrict SCALANCE management access
# Replace interface, source, and device addresses with your environment values
iptables -A FORWARD -s 10.10.20.0/24 -d 192.0.2.10 -p udp --dport 161 -j ACCEPT
iptables -A FORWARD -d 192.0.2.10 -p udp --dport 161 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.