Vulnerability · Published Mar 11, 2025 · Assigned by siemens
CVE-2024-56336
Critical 9.8
In plain English
A critical-severity improper authentication in SINAMICS S200 from Siemens. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Official description
A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The affected device contains an unlocked bootloader. This security oversight enables attackers to inject malicious code, or install untrusted firmware. The intrinsic security features designed to protect against data manipulation and unauthorized access are compromised when the bootloader is not secured.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Siemens | SINAMICS S200 | 0 – before * |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H