{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SICAM Toolbox II device communication",
          "vendor": "Siemens",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20261104-0 \u003e\n=======================================================================\n              title: Improper device certificate validation enables AiTM attacks\n            product: Siemens SICAM Toolbox II device communication\n vulnerable version: \u003cV07.11\n\u00a0 \u00a0 \u00a0 fixed version: V07.11\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2024-31853, CVE-2024-31854\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: High\n           homepage:https://www.siemens.com/en-us/products/sicam/toolbox-ii/\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2023-10-16\n                 by: Stefan Viehb\u00f6ck\n                     Constantin Schieber-Kn\u00f6bl (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"Siemens SICAM Toolbox II - Engineering software for SICAM RTUs.\nSICAM TOOLBOX II provides all functions for integrated and standard\nengineering throughout the entire plant, e.g.: Data collection, data\nmodeling, configuration, and parameterization. Engineering of process\ninformation for the automation and central control-room systems.\nSICAM TOOLBOX II is an ideal tool for plants and systems of all sizes.\"\n\nSource:https://www.siemens.com/global/en/products/energy/energy-automation-and-smart-grid/substation-automation/engineering-software-for-sicam-rtus-sicam-toolbox-ii.html\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides a patched version V07.11 or higher since July 2025.\n\nSEC Consult highly recommends to perform a thorough security review of the product\nconducted by security professionals to identify and resolve potential further\nsecurity issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Improper device certificate validation enables AiTM attacks (CVE-2024-31853, CVE-2024-31854)\nThe SICAM Toolbox II connects with supported devices via an HTTPS connection\n(TCP port 443, TLS1.2). The Toolbox II software uses a hard-coded client\ncertificate issued by the same Siemens CA when connecting to a device. Each\ndevice uses a device-specific certificate issued by a Siemens CA\n(\"SICAM1703-Access-V1\") as a server certificate. The certificate is\ngenerated/signed during the production process. The common name is the device\nserial number.\n\nDue to a vulnerability in the certificate validation during the TLS connection,\nan attacker can perform an adversary-in-the-middle-attack.\n\nThe Toolbox II software only checks if the certificate was issued by the\ntrusted CA, but does not check if the certificate is actually issued to the target\ndevice (e.g. by checking the certificate common name against an expected\nvalue). It is even possible to use the hard-coded Toolbox II client certificate\ninstead of an actual device-specific certificate.\n\nThis attack can be used to steal RTU connection passwords, process data or modify\nthe device configuration.\n\n\nProof of concept:\n-----------------\n1) Improper device certificate validation enables AiTM attacks (CVE-2024-31853, CVE-2024-31854)\nAn attacker requires the private key of any certificate issued by the\n\"SICAM1703-Access-V1\" CA for successful exploitation.\n\nThe most simple way to exploit the vulnerability is to extract the\ncertificate/private key pair from the Toolbox II software. The P12 container\ncan be found in the satzp.exe executable (located in /EMII/BIN/). The P12 file\nis stored in obfuscated form and de-obfuscated at runtime when establishing new\nTLS connections. Furthermore the P12 container is protected by a passphrase which\nis stored in obfuscated form as well.\n\nUnlike a regular device-specific certificate, the common name of this\ncertificate is \"ToolboxII\" and the extended key usage is \"TLS Web Client\nAuthentication\".\n\nAlternatively an attacker could also extract a device-specific certificate\nprivate key from a device (from the VaultIC chip).\n\nBelow is the Toolbox II client certificate and the corresponding private key\n(redacted).\n\nCertificate:\n    Data:\n        Version: 3 (0x2)\n        Serial Number: 2 (0x2)\n        Signature Algorithm: sha256WithRSAEncryption\n        Issuer: C = DE, ST = Deutschland, L = Berlin, O = Siemens AG, OU = Energy Automation, CN = SICAM1703-Access-V1\n        Validity\n            Not Before: Jan  1 01:01:01 2011 GMT\n            Not After : Dec 31 23:59:59 9999 GMT\n        Subject: C = DE, ST = Deutschland, L = Berlin, O = Siemens AG, OU = Energy Automation, CN = ToolboxII\n        Subject Public Key Info:\n            Public Key Algorithm: rsaEncryption\n                RSA Public-Key: (2048 bit)\n                Modulus:\n                    00:eb:56:a3:40:86:72:42:42:ca:1c:6c:25:41:11:\n                    09:1d:20:ad:79:71:14:94:5c:02:a0:95:a6:ce:26:\n                    1f:30:e2:21:9e:39:30:66:35:0c:df:77:e5:60:0b:\n                    76:89:66:4a:08:f1:27:65:84:fc:d9:f1:b0:a3:b4:\n                    4b:cf:dc:30:da:93:2b:74:e8:ac:3e:c5:5b:00:dd:\n                    a9:03:79:f6:38:c5:1a:26:87:51:dd:1c:ad:72:b6:\n                    c2:97:4c:62:f1:82:aa:86:e7:79:c9:82:b9:53:5b:\n                    8d:40:26:76:1d:b0:03:2f:ce:ec:6e:f2:4a:af:79:\n                    f3:e1:67:8b:c0:52:3b:f1:3e:dc:0d:8f:a4:f8:20:\n                    e5:92:e3:ff:97:2b:34:a8:90:2c:79:42:3a:d0:e8:\n                    ff:0d:d0:98:64:a8:5f:76:5f:e3:d8:bd:3e:85:3d:\n                    49:33:ab:ae:54:5c:2a:2d:70:d0:95:3f:aa:cb:2d:\n                    bf:34:f3:a2:f9:ae:17:a9:97:8f:a3:e2:ad:ad:f2:\n                    ab:55:57:5b:04:56:b8:26:c3:fc:04:81:c9:ea:f5:\n                    83:34:25:4a:22:9e:d5:73:6e:a4:d4:96:5b:65:3f:\n                    cc:9d:97:df:6e:62:49:ae:a4:f2:4a:28:04:65:7d:\n                    3d:7a:af:ba:69:49:75:32:a0:51:f0:93:69:fd:da:\n                    eb:d1\n                Exponent: 65537 (0x10001)\n        X509v3 extensions:\n            X509v3 Subject Alternative Name:\n                email:support.energy () siemens com\n            X509v3 Key Usage: critical\n                Digital Signature, Key Encipherment, Data Encipherment\n            X509v3 Extended Key Usage: critical\n                TLS Web Client Authentication\n    Signature Algorithm: sha256WithRSAEncryption\n         21:15:68:6e:5c:34:80:a7:95:d5:a9:fa:62:64:6f:16:63:c5:\n         8f:d6:42:c3:d3:dc:41:b4:98:e1:9c:13:47:d0:c7:c6:6c:66:\n         a5:27:1e:b2:f1:99:5b:17:cc:63:78:2e:d5:26:84:8a:58:68:\n         81:ee:f9:4f:0a:46:09:ec:23:77:e2:d6:f9:51:31:80:34:c3:\n         9f:e5:45:01:e4:e9:5e:2e:94:08:ea:80:7b:1b:25:01:95:32:\n         5c:6b:5b:30:8c:a5:5c:e4:b2:99:2a:83:22:ee:82:55:6e:d6:\n         38:57:8e:37:54:53:89:03:8d:1a:26:2c:15:a2:d9:6f:88:c5:\n         b0:a4:4b:e8:85:43:9d:25:c1:f4:eb:c0:b0:14:d0:7f:32:d7:\n         d1:54:34:28:7d:a7:59:ff:35:25:9f:33:df:18:8f:1f:74:cd:\n         c2:51:a0:06:35:d2:4d:c5:c3:b2:3e:b4:b0:05:fb:30:d1:c1:\n         44:44:84:d6:90:ce:24:b3:2f:a4:4a:8b:d0:04:11:50:22:16:\n         8e:39:1f:53:1d:e2:73:e0:c7:7b:2a:3a:4d:6b:83:e8:38:33:\n         a9:10:e8:f0:1d:42:d2:54:67:3b:14:7a:03:48:16:a3:cd:7b:\n         96:20:7f:de:cf:fc:ee:c6:37:e1:29:10:61:4f:22:de:46:cf:\n         d1:0d:8f:5a\n-----BEGIN CERTIFICATE-----\nMIIDyzCCArOgAwIBAgIBAjANBgkqhkiG9w0BAQsFADCBgzELMAkGA1UEBhMCREUx\nFDASBgNVBAgTC0RldXRzY2hsYW5kMQ8wDQYDVQQHEwZCZXJsaW4xEzARBgNVBAoT\nClNpZW1lbnMgQUcxGjAYBgNVBAsTEUVuZXJneSBBdXRvbWF0aW9uMRwwGgYDVQQD\nExNTSUNBTTE3MDMtQWNjZXNzLVYxMCIYDzIwMTEwMTAxMDEwMTAxWhgPOTk5OTEy\nMzEyMzU5NTlaMHkxCzAJBgNVBAYTAkRFMRQwEgYDVQQIEwtEZXV0c2NobGFuZDEP\nMA0GA1UEBxMGQmVybGluMRMwEQYDVQQKEwpTaWVtZW5zIEFHMRowGAYDVQQLExFF\nbmVyZ3kgQXV0b21hdGlvbjESMBAGA1UEAxMJVG9vbGJveElJMIIBIDALBgkqhkiG\n9w0BAQEDggEPADCCAQoCggEBAOtWo0CGckJCyhxsJUERCR0grXlxFJRcAqCVps4m\nHzDiIZ45MGY1DN935WALdolmSgjxJ2WE/NnxsKO0S8/cMNqTK3TorD7FWwDdqQN5\n9jjFGiaHUd0crXK2wpdMYvGCqobnecmCuVNbjUAmdh2wAy/O7G7ySq958+Fni8BS\nO/E+3A2PpPgg5ZLj/5crNKiQLHlCOtDo/w3QmGSoX3Zf49i9PoU9STOrrlRcKi1w\n0JU/qsstvzTzovmuF6mXj6Pira3yq1VXWwRWuCbD/ASByer1gzQlSiKe1XNupNSW\nW2U/zJ2X325iSa6k8kooBGV9PXqvumlJdTKgUfCTaf3a69ECAwEAAaNRME8wJQYD\nVR0RBB4wHIEac3VwcG9ydC5lbmVyZ3lAc2llbWVucy5jb20wDgYDVR0PAQEBBAQD\nAgSwMBYGA1UdJQEBAQQMMAoGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAh\nFWhuXDSAp5XVqfpiZG8WY8WP1kLD09xBtJjhnBNH0MfGbGalJx6y8ZlbF8xjeC7V\nJoSKWGiB7vlPCkYJ7CN34tb5UTGANMOf5UUB5OleLpQI6oB7GyUBlTJca1swjKVc\n5LKZKoMi7oJVbtY4V443VFOJA40aJiwVotlviMWwpEvohUOdJcH068CwFNB/MtfR\nVDQofadZ/zUlnzPfGI8fdM3CUaAGNdJNxcOyPrSwBfsw0cFERITWkM4ksy+kSovQ\nBBFQIhaOOR9THeJz4Md7KjpNa4PoODOpEOjwHULSVGc7FHoDSBajzXuWIH/ez/zu\nxjfhKRBhTyLeRs/RDY9a\n-----END CERTIFICATE-----\n\n-----BEGIN PRIVATE KEY-----\nMIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDrVqNAhnJCQsoc\nbCVBEQkdIK15cRSUXAKglabOJh8w4iGeOTBmNQzfd+VgC3aJZkoI8SdlhPzZ8bCj\ntEvP3DDakyt06Kw+xVsA3akDefY4xRomh1HdHK1ytsKXTGLxgqqG53nJgrlTW41A\n[...]\nL7bTzPviSAvMQwaa5i6vJXCvhfB6q05rYgs4i/1eWQKBgQCkSGpuCF/ZwhQZ3KmD\nrM7CoHgy4j2rbItWkIYbq9J5mJh7wpdYknY2pdRAocSLERiiLErFKU+k4QKilts2\noXLGKMem7ZxxvNVhij1g6Ypqm2bKWWkUsbW5X3WwGmYsGzMzeg+BhhxNn39Gq3QO\nPkcoHTu5hSDvo1Y+qNakl2+3Hg==\n-----END PRIVATE KEY-----\n\n\nVulnerable / tested versions:\n-----------------------------\nThe following version has been tested which was the latest version available\nat the time of the test:\n* 7.1.0.0\n\nAccording to the vendor, all versions before V07.11 are affected.\n\n\nVendor contact timeline:\n------------------------\n2023-10-22: Contacting vendor throughproductcert () siemens com\n2023-10-23: Siemens opens case #33071\n2024-01-02: Siemens confirmed the vulnerability. Patch planned for Autumn 2024.\n2024-04-03: Asking regarding fix timeline. Offering help in reviewing the new cert handling.\n2024-04-05: Siemens split the advisory into two parts and plans to release them at end of 2024:\n            CVE-2024-31853: Addresses the proper check of certificates\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE-2024-31854: Prevent AiTM attacks via certificate pinning created from first connect.\n2024-11-29: Due to other fixes that have to be integrated into the software, there won\u0027t be a release\n            this year. New release scheduled for June 2025.\n2025-02-10: Requested update. No response.\n2025-02-19: Requested update. No response.\n2025-07-04: Siemens confirms that both parts of the advisory are now fixed. A Siemens security\n            advisory release is planned for 8th July 2025.\n2025-07-07: Siemens asks SEC Consult to review the credit section of their advisory so the\n            correct people involved are present in the advisory.\n2025-07-18: The people involved are communicated to Siemens; vendor advisory updated.\n2025-07-18: Siemens releases SSA-183963 (https://cert-portal.siemens.com/productcert/html/ssa-183963.html)\n2025-2026: Internal delays at SEC Consult, advisory got lost. No information from vendor as well.\n2026-10-28: Informing Siemens about scheduled advisory release; no response.\n2026-11-03: Attempting to contact vendor via LinkedIn, immediate response from one contact, tickets\n            were somehow disconnected. Received feedback and confirmation for fixes.\n2026-11-04: Coordinated publication of advisory.\n\n\nSolution:\n---------\nThe vendor has released software updates (V07.11 or higher) for the identified\nsecurity issues back in July 2025:\nhttps://support.industry.siemens.com/cs/ww/en/view/109822197/\n\nFurther security advisory information from the vendor:\nhttps://cert-portal.siemens.com/productcert/html/ssa-183963.html\n\n\nWorkaround:\n-----------\nNone\n\n\nAdvisory URL:\n-------------\nhttps://sec-consult.com/vulnerability-lab/\n\n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nSEC Consult Vulnerability Lab\nAn integrated part of SEC Consult, an Atos business\nEurope | Asia\n\nAbout SEC Consult Vulnerability Lab\nThe SEC Consult Vulnerability Lab is an integrated part of SEC Consult, an\nAtos business. It ensures the continued knowledge gain of SEC Consult in the\nfield of network and application security to stay ahead of the attacker. The\nSEC Consult Vulnerability Lab supports high-quality pe"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-05T04:54:03Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/12"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Nov/12"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://cert-portal.siemens.com/productcert/html/ssa-183963.html"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://support.industry.siemens.com/cs/ww/en/view/109822197/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.siemens.com/en-us/products/sicam/toolbox-ii/"
        },
        {
          "url": "https://www.siemens.com/global/en/products/energy/energy-automation-and-smart-grid/substation-automation/engineering-software-for-sicam-rtus-sicam-toolbox-ii.html"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Nov/12"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20261104-0 :: Improper device certificate validation enables AiTM attacks in Siemens SICAM Toolbox II device communication",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2024-31853",
              "type": "related"
            },
            {
              "destId": "CVE-2024-31854",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0551",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Nov/12",
            "automated": true,
            "contentSha256": "b5a0ffb05efc0d283299bd616ebcf732517bf0b6aceed5117906e0bc0acffb49",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Nov/12",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-11-04T08:24:01Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0551"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-05T04:54:03Z",
    "dateUpdated": "2026-11-05T04:54:03Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0551"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}