Siemens SENTRON 3NA COM Fuse Denial-of-Service Vulnerability (CVE-2024-7322)

Siemens SENTRON 3NA COM Fuse devices are affected by a Denial-of-Service vulnerability identified as CVE-2024-7322. The vulnerability arises from improper verification of the source of a communication channel. According to the advisory, a ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received. This change in node ID causes a Denial of Service (DoS) condition. To recover from this DoS, the network must be re-established to restore normal operation.

The affected product is SENTRON 3NA COM Fuse versions earlier than V5.2. Siemens ProductCERT reported the vulnerability to CISA. The CVSS 3.1 base score is 5.8, rated MEDIUM. The issue impacts critical infrastructure sectors globally, including Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services, and Government Services and Facilities.

Siemens recommends protecting network access to devices with appropriate mechanisms and configuring the environment according to Siemens' operational guidelines for Industrial Security. Users are advised to update to SENTRON 3NA COM Fuse V5.2 or later to remediate the vulnerability. CISA recommends minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, locating control system networks and remote devices behind firewalls, and isolating them from business networks. When remote access is required, more secure methods such as Virtual Private Networks (VPNs) should be used, and VPNs should be updated to the most current version available.