No exploitation reportedFix available

CVE-2024-31484

Q: Is CVE-2024-31484 actively exploited?

Active exploitation of CVE-2024-31484 has not been confirmed. Its EPSS score was 0.5% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

Q: What is the CVSS score for CVE-2024-31484?

CVE-2024-31484 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

No exploitation reported by the sources we read.

Published2024-05-14
Fixed in16.41
WeaknessCWE-170

Am I affected?

With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.

Description

A vulnerability has been identified in CPC80 Central Processing/Communication (All versions < V16.41), CPCI85 Central Processing/Communication (All versions < V5.30), CPCX26 Central Processing/Communication (All versions < V06.02), ETA4 Ethernet Interface IEC60870-5-104 (All versions < V10.46), ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 (All versions < V03.27), PCCX26 Ax 1703 PE, Contr, Communication Element (All versions < V06.05). The affected devices contain an improper null termination vulnerability while parsing a specific HTTP header. This could allow an attacker to execute code in the context of the current process or lead to denial of service condition.

Timeline

dates in UTC

2024-05-1416:16CVE publishedNVD

Versions per branch

CISA-ADP

Siemens cpc80 central processing\/communication

Branch	Affected	Fixed in	Source
16.41	< 16.41	16.41	CISA-ADP

Siemens cpci85 central processing\/communication

Branch	Affected	Fixed in	Source
5.30	< 5.30	5.30	CISA-ADP

as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.

Products declared by the CNA6 products

As siemens, the CNA that assigned this CVE, declared them in the CVE record; versions as written.

Siemens CPC80 Central Processing/Communicationother versions: unknown
Affected
- < V16.41fixed in V16.41custom
Siemens CPCI85 Central Processing/Communicationother versions: unknown
Affected
- < V5.30fixed in V5.30custom
Siemens CPCX26 Central Processing/Communicationother versions: unknown
Affected
- < V06.02fixed in V06.02custom
Siemens ETA4 Ethernet Interface IEC60870-5-104other versions: unknown
Affected
- < V10.46fixed in V10.46custom
Siemens ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2other versions: unknown
Affected
- < V03.27fixed in V03.27custom
Siemens PCCX26 Ax 1703 PE, Contr, Communication Elementother versions: unknown
Affected
- < V06.05fixed in V06.05custom

Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of Use CVE recordupdated 2024-06-11

Distribution builds and vendor advisories

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

ICSA-24-165-09 CISA4 known affected
Siemens SICAM AK3/BC/TM
CPCX26 Central Processing/Communication · ETA4 Ethernet Interface IEC60870-5-104 · ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 · +1 more
SSA-620338 Siemens ProductCERT4 known affected
SSA-620338: Buffer Overflow Vulnerability in SICAM AK3 / BC / TM
CPCX26 Central Processing/Communication · ETA4 Ethernet Interface IEC60870-5-104 · ETA5 Ethernet Int. 1x100TX IEC61850 Ed.2 · +1 more
ICSA-24-137-02 CISA2 known affected
Siemens SICAM Products
CPC80 Central Processing/Communication · CPCI85 Central Processing/Communication
SSA-871704 Siemens ProductCERT2 known affected
SSA-871704: Multiple Vulnerabilities in SICAM Products
CPC80 Central Processing/Communication · CPCI85 Central Processing/Communication

Full record on NVD

Fix

Update Siemens cpc80 central processing\/communication to 16.41
Vendor fix Siemens ProductCERT SSA-620338 · 1 productUpdate to V06.02 or later version. The firmware CPCX26 V06.02 is present within “SICAM RTUs AK3 Package” V06.02
Vendor fix Siemens ProductCERT SSA-620338 · 1 productUpdate to V06.05 or later version The firmware PCCX26 V06.05 is present within “SICAM RTUs AK3 Package” V06.02
Vendor fix Siemens ProductCERT SSA-620338 · 1 productUpdate to V10.46 or later version The firmware ETA4 V10.46 is present within “SICAM RTUs AK3 Package” V06.02
Vendor fix Siemens ProductCERT SSA-620338 · 1 productUpdate to V03.27 or later version The firmware ETA5 V03.27 is present within “SICAM RTUs AK3 Package” V06.02
Vendor fix CISA ICSA-24-165-09 · 1 productUpdate to V06.02 or later version. The firmware CPCX26 V06.02 is present within “SICAM RTUs AK3 Package” V06.02
Vendor fix CISA ICSA-24-165-09 · 1 productUpdate to V06.05 or later version The firmware PCCX26 V06.05 is present within “SICAM RTUs AK3 Package” V06.02

Detection

Nuclei template: none so far
Exploit-DB: no entry
Proof of concept: PoC-in-GitHubno public repository identifiedread 2026-11-08
Metasploit modules: none listed

Sources

NVDCVE recordread 2026-10-23
CISA-ADPSSVC decisionnone2024-05-28
CNACVSS 4.07.3known since 2026-10-23
CNACVSS 3.17.8known since 2026-10-23
CNAweakness (CWE)CWE-170known since 2026-10-23
FIRST EPSSEPSS score0.5 %2026-11-08
GitHub Advisoriesadvisory—

Identifiers

EUVD-2024-29364same flawENISA EUVD · LicenseRef-ENISA-legal-notice
GHSA-42vc-vfqh-cr2xsame flawGitHub Advisory Database · CC-BY-4.0

Technical details

CVSS v3 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 4.0 vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: 2024-05-14
Last Modified: 2026-06-17
NVD status: Deferred
GitHub Advisory: GHSA-42vc-vfqh-cr2x

Frequently asked questions

What is CVE-2024-31484?

Is CVE-2024-31484 actively exploited?

Active exploitation of CVE-2024-31484 has not been confirmed. Its EPSS score was 0.5% on 2026-11-08, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2024-31484?

CVE-2024-31484 has a CVSS v3 base score of 7.8 (HIGH severity), with vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.

Running CPC80 Central? Hear about its next vulnerability

Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».

Get alerts for this product CISA KEV additions, November 2026 Search CVEs

No credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database

Sources for this record

MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CVE records are reproduced under the CVE Program Terms of Use: MITRE grants a perpetual, royalty-free licence to reproduce and redistribute them, provided this designation and the licence travel with every copy. Read the licence

This product uses data from the NVD API but is not endorsed or certified by the NVD.

Sources and licences of the CVE data