Medium severity · published Dec 10, 2024
CVE-2024-53832
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30)
4.6
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CPCI85 Central Processing/Communication · Siemens
before V05.30 · source: vendor
Affected product
CC
CPCI85 Central Processing/Communication
Siemens
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-53832
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-53832
cert-portal.siemens.com
https://cert-portal.siemens.com/productcert/html/ssa-128393.html
seclists.org
http://seclists.org/fulldisclosure/2025/Feb/19
More from CPCI85 Central Processing/Communication
9.8
CVE-2024-37998
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0)
9.0
CVE-2024-3596
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
7.8
CVE-2024-31484
A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26…
7.5
CVE-2026-27664
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.10), SICORE Base system (All versions < V26.10.0)
7.2
CVE-2026-54801
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0)