CVE-2024-39601

MEDIUM

CPCI85 Central Processing/Communication <5.40 - Privilege Escalation

Title source: llm

Description

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical access to downgrade the firmware of the device. This could allow an attacker to downgrade the device to older versions with known vulnerabilities.

References (2)

Core 2

Core References

Vendor Advisory

https://cert-portal.siemens.com/productcert/html/ssa-071402.html

Mailing List

http://seclists.org/fulldisclosure/2025/Feb/19

Scores

CVSS v3 6.5

EPSS 0.0043

EPSS Percentile 62.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-306

Status published

Products (2)

Siemens/CPCI85 Central Processing/Communication < V5.40

Siemens/SICORE Base system < V1.4.0

Published Jul 22, 2024

Tracked Since Feb 18, 2026