Denial‑of‑Service Vulnerability (CVE‑2024‑7322) Impacts Siemens SENTRON 3NA COM Fuse Industrial Controllers
What It Is — Siemens SENTRON 3NA COM Fuse firmware versions prior to 5.2 contain an improper verification of the source of a ZigBee network‑management message. An attacker who can inject an unsolicited encrypted re‑join response can force the device to change its node ID, resulting in a denial‑of‑service (DoS) condition.
Exploitability — CVSS v3.1 base score 5.8 (Medium). No public exploit code has been released, but the vulnerability is network‑reachable on any segment that permits ZigBee management traffic.
Affected Products — Siemens SENTRON 3NA COM Fuse < v5.2 (industrial control equipment used in energy, manufacturing, transportation, and other critical infrastructure).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of firmware versions and rapid evidence collection to prove timely patching.
- Highlights gaps in network‑segmentation and source‑validation controls that map to multiple frameworks (e.g., NIST CSF 2.0 “Detect” and “Respond” functions).
- Provides a concrete incident that buyers will scrutinize when demanding defensible audit trails for critical‑infrastructure assets.
Recommended Actions
- Apply Siemens‑provided firmware update to version 5.2 or later.
- Verify that ZigBee management traffic is confined to isolated, monitored network zones.
- Augment logging of ZigBee communication events and retain logs for audit purposes.
- Incorporate the patch‑status check into your continuous control‑monitoring platform.
Source: CISA Advisory – ICSA‑26‑295‑05