#VU109894 Incorrect permission assignment for critical resource in SIRIUS 3RK3 Modular Safety System (MSS) and SIRIUS Safety Relays 3SK2 - CVE-2025-24009

Vulnerability identifier: #VU109894

Vulnerability risk: High

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-24009

CWE-ID: CWE-732

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
SIRIUS 3RK3 Modular Safety System (MSS)
Hardware solutions / Firmware
SIRIUS Safety Relays 3SK2
Hardware solutions / Firmware

Vendor: Siemens

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to incorrect permission assignment for critical resource. A remote attacker can retrieve sensitive information from certain data records.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

SIRIUS 3RK3 Modular Safety System (MSS): All versions

SIRIUS Safety Relays 3SK2: All versions

---

External links
https://cert-portal.siemens.com/productcert/html/ssa-222768.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.