Full Report
SIMATIC CN 4100 contains multiple vulnerabilities which could potentially lead to a compromise in availability, integrity and confidentiality. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest version.
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in SIMATIC CN 4100
## CVE Details
*Note: The advisory (SSA-032379) covers multiple vulnerabilities; the primary identified IDs and scores are as follows:*
- **CVE ID:** CVE-2024-57924, CVE-2025-23160, CVE-2026-31790 (and others)
- **CVSS Score:** 9.6 (Critical) / 8.8 (High)
- **CWE:** CWE-476 (NULL Pointer Dereference), CWE-401 (Memory Leak), CWE-787 (Out-of-bounds Write), CWE-754 (Improper Check for Unusual Conditions)
## Affected Systems
- **Products:** SIMATIC CN 4100
- **Versions:** All versions before V5.0
- **Configurations:** Systems utilizing the SIMATIC CN 4100 for industrial communication and data integration.
## Vulnerability Description
SIMATIC CN 4100 contains a collection of vulnerabilities ranging from Linux kernel-level flaws to OpenSSL library issues. Technical defects include:
- **NULL Pointer Dereferences:** Found in Linux kernel modules (e.g., in `dp_enable_link_phy` and `hlock_class`), which can cause system crashes or Denial of Service (DoS) when specific functions pass uninitialized resources.
- **Resource Leaks:** Improper handling of firmware initialization in system companion processors leads to memory exhaustion.
- **Encryption Flaws (OpenSSL):** Improper error handling in RSA_public_encrypt allows the application to proceed despite encryption failure, potentially leaking sensitive uninitialized memory buffer contents to an attacker via RSASVE key encapsulation.
## Exploitation
- **Status:** PoC details are outlined for some underlying kernel flaws (e.g., involving `cifs` module unloading); no widespread exploitation in the wild for the specific CN 4100 implementation is currently reported in the advisory.
- **Complexity:** Low to High (depending on the specific CVE)
- **Attack Vector:** Network (for OpenSSL/RSASVE issues), Local (for kernel-level dereferences).
## Impact
- **Confidentiality:** High (Risk of sensitive data leakage via uninitialized memory)
- **Integrity:** Medium (Potential for compromise depending on the component)
- **Availability:** High (System crashes, DoS via kernel oops or memory leaks)
## Remediation
### Patches
Siemens has released a new version to address these vulnerabilities:
- **SIMATIC CN 4100 V5.0:** Update to this version or later to resolve the identified flaws.
### Workarounds
- **OpenSSL (CVE-2026-31790):** For applications using RSASVE, call `EVP_PKEY_public_check()` before `EVP_PKEY_encapsulate()`.
- **System Hardening:** Restrict physical and network access to the SIMATIC CN 4100 to authorized personnel and management networks only.
## Detection
- **Indicators of Compromise:** Unusual system reboots (kernel oops), memory exhaustion alerts, or unauthorized network traffic patterns.
- **Detection methods and tools:** Monitor system logs for `BUG: kernel NULL pointer dereference` or `WARNING: hlock_class` messages. Use network security monitoring to detect attempts to exploit OpenSSL vulnerabilities.
## References
- **Vendor Advisory:** hxxps://cert-portal[.]siemens[.]com/productcert/html/ssa-032379[.]html
- **Siemens ProductCERT:** hxxps://www[.]siemens[.]com/cert/advisories