CVE-2024-31484: Siemens CPC80 Central Processing/communication

High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days.

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Affected products

• Siemens CPC80 Central Processing/communication: before V16.41 (fixed in V16.41)
• Siemens CPC80 Central Processing\/communication: before 16.41 (fixed in 16.41)
• Siemens CPCI85 Central Processing/communication: before V5.30 (fixed in V5.30)
• Siemens CPCI85 Central Processing\/communication: before 5.30 (fixed in 5.30)
• Siemens CPCX26 Central Processing/communication: before V06.02 (fixed in V06.02)
• Siemens ETA4 Ethernet Interface IEC60870-5-104: before V10.46 (fixed in V10.46)
• Siemens ETA5 Ethernet Int. 1x100tx IEC61850 ed.2: before V03.27 (fixed in V03.27)
• Siemens PCCX26 Ax 1703 Pe, Contr, Communication Element: before V06.05 (fixed in V06.05)

Published 2024-05-14. Last modified 2026-06-17.