CVE-2024-56336
Published: 11 March 2025
Summary
CVE-2024-56336 is a critical-severity Improper Authentication (CWE-287) vulnerability. Its CVSS base score is 9.5 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-56336 is a critical vulnerability affecting SINAMICS S200 drives in all versions with serial numbers beginning with SZVS8, SZVS9, SZVS0, or SZVSN and an FS number of 02. The issue stems from an unlocked bootloader (CWE-287: Improper Authentication), which bypasses intrinsic security features designed to prevent data manipulation and unauthorized access. This allows attackers to inject malicious code or install untrusted firmware, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote attackers with network access to the device can exploit this vulnerability without authentication, privileges, or user interaction. Successful exploitation enables full compromise of the device, including high-impact confidentiality, integrity, and availability violations through arbitrary code execution or firmware replacement.
Siemens has published security advisory SSA-787280, available at https://cert-portal.siemens.com/productcert/html/ssa-787280.html, which provides details on mitigation and remediation steps for affected SINAMICS S200 drives.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54277
Vulnerability details
A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS number is 02). The affected device contains an unlocked bootloader. This security oversight enables attackers to inject…
more
malicious code, or install untrusted firmware. The intrinsic security features designed to protect against data manipulation and unauthorized access are compromised when the bootloader is not secured.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The unlocked bootloader vulnerability enables remote unauthenticated network exploitation of the device for arbitrary code execution and untrusted firmware installation, directly mapping to T1190 for exploiting the exposed application/service and T1542.001 for replacing system firmware.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-7 requires integrity checks on software and firmware before execution, directly preventing malicious code injection or untrusted firmware loading via the unlocked bootloader.
CM-14 enforces digital signature verification prior to installing or updating firmware, blocking untrusted firmware installation enabled by the unlocked bootloader.
SI-2 mandates timely flaw remediation, including applying Siemens' security advisory patches to lock the bootloader and address the vulnerability.