CVE-2024-56181: High severity Siemens Simatic Field Pg M5 vulnerability

Published Mar 11, 2025
·
Updated

A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions < V31.01.07), SIMATIC IPC BX-32A (All versions < V29.01.07), SIMATIC IPC BX-39A (All versions < V29.01.07), SIMATIC IPC BX-59A (All versions < V32.01.04), SIMATIC IPC PX-32A (All versions < V29.01.07), SIMATIC IPC PX-39A (All versions < V29.01.07), SIMATIC IPC PX-39A PRO (All versions < V29.01.07), SIMATIC IPC RC-543A (All versions < V36.01.03), SIMATIC IPC RC-543B (All versions < V35.01.12), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC RW-543B (All versions < V35.02.10), SIMATIC IPC127E (All versions < V27.01.11), SIMATIC IPC227E (All versions), SIMATIC IPC227G (All versions < V28.01.14), SIMATIC IPC277E (All versions), SIMATIC IPC277G (All versions < V28.01.14), SIMATIC IPC277G PRO (All versions < V28.01.14), SIMATIC IPC3000 SMART V3 (All versions), SIMATIC IPC327G (All versions < V28.01.14), SIMATIC IPC347G (All versions), SIMATIC IPC377G (All versions < V28.01.14), SIMATIC IPC427E (All versions < V21.01.21), SIMATIC IPC477E (All versions < V21.01.21), SIMATIC IPC477E PRO (All versions < V21.01.21), SIMATIC IPC527G (All versions), SIMATIC IPC627E (All versions < V25.02.15), SIMATIC IPC647E (All versions < V25.02.15), SIMATIC IPC677E (All versions < V25.02.15), SIMATIC IPC847E (All versions < V25.02.15), SIMATIC ITP1000 (All versions). The affected devices have insufficient protection mechanism for the EFI(Extensible Firmware Interface) variables stored on the device. This could allow an authenticated attacker to alter the secure boot configuration without proper authorization by directly communicate with the flash controller.

Affected Software

31 affected components
Siemens Simatic Field Pg M5=All versions
Siemens SIMATIC IPC BX-21A<V31.01.07
Siemens SIMATIC IPC BX-32A<V29.01.07
Siemens SIMATIC IPC BX-39A<V29.01.07
Siemens SIMATIC IPC BX-59A<V32.01.04
Siemens SIMATIC IPC PX-32A<V29.01.07
Siemens SIMATIC IPC PX-39A<V29.01.07
Siemens SIMATIC IPC PX-39A PRO<V29.01.07
Siemens SIMATIC IPC RC-543A<V36.01.03
Siemens SIMATIC IPC RC-543B<V35.01.12
Siemens SIMATIC IPC RW-543A<V1.1.4
Siemens SIMATIC IPC RW-543B<V35.02.10
Siemens Simatic Ipc127e<V27.01.11
Siemens SIMATIC IPC227E=All versions
Siemens Simatic Ipc227g<V28.01.14
Siemens SIMATIC IPC277E=All versions
Siemens Simatic Ipc277g<V28.01.14
Siemens SIMATIC IPC277G PRO<V28.01.14
Siemens SIMATIC IPC3000 SMART V3=All versions
Siemens Simatic Ipc327g<V28.01.14
Siemens SIMATIC IPC347G=All versions
Siemens Simatic Ipc377g<V28.01.14
Siemens Simatic Ipc427e<=All versions (as stated)
Siemens Simatic Ipc477e<=All versions (as stated)
Siemens Simatic Ipc477e Pro<=All versions (as stated)
Siemens Simatic Ipc527g=All versions
Siemens Simatic Ipc627e<V25.02.15
Siemens Simatic Ipc647e<V25.02.15
Siemens Simatic Ipc677e<V25.02.15
Siemens Simatic Ipc847e<V25.02.15
Siemens SIMATIC ITP1000=All versions

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade SIMATIC IPC BX-21A to a version that resolves this vulnerability.

    Fixed in V31.01.07
  2. Upgrade

    Upgrade SIMATIC IPC BX-32A to a version that resolves this vulnerability.

    Fixed in V29.01.07
  3. Upgrade

    Upgrade SIMATIC IPC BX-39A to a version that resolves this vulnerability.

    Fixed in V29.01.07
  4. Upgrade

    Upgrade SIMATIC IPC BX-59A to a version that resolves this vulnerability.

    Fixed in V32.01.04
  5. Upgrade

    Upgrade SIMATIC IPC PX-32A to a version that resolves this vulnerability.

    Fixed in V29.01.07
  6. Upgrade

    Upgrade SIMATIC IPC PX-39A to a version that resolves this vulnerability.

    Fixed in V29.01.07
  7. Upgrade

    Upgrade SIMATIC IPC PX-39A PRO to a version that resolves this vulnerability.

    Fixed in V29.01.07
  8. Upgrade

    Upgrade SIMATIC IPC RC-543A to a version that resolves this vulnerability.

    Fixed in V36.01.03
  9. Upgrade

    Upgrade SIMATIC IPC RC-543B to a version that resolves this vulnerability.

    Fixed in V35.01.12
  10. Upgrade

    Upgrade SIMATIC IPC RW-543A to a version that resolves this vulnerability.

    Fixed in V1.1.4
  11. Upgrade

    Upgrade SIMATIC IPC RW-543B to a version that resolves this vulnerability.

    Fixed in V35.02.10
  12. Upgrade

    Upgrade SIMATIC IPC127E to a version that resolves this vulnerability.

    Fixed in V27.01.11
  13. Upgrade

    Upgrade SIMATIC IPC227E to a version that resolves this vulnerability.

    Fixed in All versions
  14. Upgrade

    Upgrade SIMATIC IPC3000 SMART V3 to a version that resolves this vulnerability.

    Fixed in All versions
  15. Upgrade

    Upgrade SIMATIC IPC277E to a version that resolves this vulnerability.

    Fixed in All versions
  16. Upgrade

    Upgrade SIMATIC IPC427E to a version that resolves this vulnerability.

    Fixed in All versions
  17. Upgrade

    Upgrade SIMATIC IPC477E to a version that resolves this vulnerability.

    Fixed in All versions
  18. Upgrade

    Upgrade SIMATIC IPC477E PRO to a version that resolves this vulnerability.

    Fixed in All versions
  19. Upgrade

    Upgrade SIMATIC IPC527G to a version that resolves this vulnerability.

    Fixed in All versions
  20. Upgrade

    Upgrade SIMATIC IPC347G to a version that resolves this vulnerability.

    Fixed in All versions
  21. Upgrade

    Upgrade SIMATIC IPC377G to a version that resolves this vulnerability.

    Fixed in All versions
  22. Upgrade

    Upgrade SIMATIC IPC227G to a version that resolves this vulnerability.

    Fixed in V28.01.14
  23. Upgrade

    Upgrade SIMATIC IPC277G to a version that resolves this vulnerability.

    Fixed in V28.01.14
  24. Upgrade

    Upgrade SIMATIC IPC277G PRO to a version that resolves this vulnerability.

    Fixed in V28.01.14
  25. Upgrade

    Upgrade SIMATIC IPC327G to a version that resolves this vulnerability.

    Fixed in V28.01.14
  26. Upgrade

    Upgrade SIMATIC IPC627E to a version that resolves this vulnerability.

    Fixed in V25.02.15
  27. Upgrade

    Upgrade SIMATIC IPC647E to a version that resolves this vulnerability.

    Fixed in V25.02.15
  28. Upgrade

    Upgrade SIMATIC IPC677E to a version that resolves this vulnerability.

    Fixed in V25.02.15
  29. Upgrade

    Upgrade SIMATIC IPC847E to a version that resolves this vulnerability.

    Fixed in V25.02.15
  30. Upgrade

    Upgrade SIMATIC Field PG M5 to a version that resolves this vulnerability.

    Fixed in All versions
  31. Upgrade

    Upgrade SIMATIC ITP1000 to a version that resolves this vulnerability.

    Fixed in All versions

Event History

Mar 11, 2025
CVE Published
via MITRE·09:48 AM
Data Sourced
via MITRE·09:48 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 AM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What devices are affected by CVE-2024-56181?

CVE-2024-56181 affects various models of Siemens SIMATIC devices including Field PG M5, IPC BX, PX series, and others with specific versions.

2

What is the severity level of CVE-2024-56181?

The severity level of CVE-2024-56181 is classified as critical due to the potential impact on the security of affected devices.

3

How can I mitigate CVE-2024-56181?

To mitigate CVE-2024-56181, it is recommended to update the affected devices to the latest firmware version that addresses this vulnerability.

4

Is CVE-2024-56181 remotely exploitable?

Yes, CVE-2024-56181 is considered remotely exploitable, which increases the risk of unauthorized access to affected systems.

5

What are the potential consequences of not addressing CVE-2024-56181?

Failure to address CVE-2024-56181 could result in unauthorized control over affected devices, leading to operational disruption and potential data compromise.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203