CVE-2024-7322: Siemens SENTRON 3NA COM Fuse Bundled Zigbee Rejoin Denial-of-Service (pending)

CVE-2024-7322 is a Zigbee protocol flaw, bundled via a third-party Zigbee stack inside Siemens' SENTRON 3NA COM Fuse low-voltage switchgear monitoring module, where an unsolicited encrypted rejoin response can force a device to change its network node ID and trigger a denial-of-service that requires rebuilding the Zigbee network; NVD has not published its own CVSS score.

CVE-2024-7322 affects the Siemens SENTRON 3NA COM Fuse, a communication module that reports status from low-voltage fuse-based switchgear (3NA-series fuses) into a plant's monitoring system — the kind of auxiliary protection/communication hardware found in Critical Manufacturing, Energy and other critical-infrastructure electrical rooms. The flaw itself originates in a third-party Zigbee protocol stack that the SENTRON module bundles rather than in code Siemens wrote itself: NVD's description states "a ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established," classified as CWE-940 (Improper Verification of Source of a Communication Channel) (NVD).

The CVE was originally assigned and scored by Silicon Labs ([email protected]) in a community advisory about its Zigbee stack implementation, then surfaced again via Siemens' own ProductCERT advisory for the SENTRON product that bundles it, and finally republished by CISA as an ICS advisory on 2026-10-22 — nearly two years after the CVE's original 2025-01-15 publication, illustrating how a single upstream protocol-stack bug can resurface across multiple vendors' product advisories as each one discloses its own affected device (NVD, Siemens Security Advisory SSA-099819).

CVE-2024-7322's NVD status is "Deferred," with no NVD-published Primary score. The only figure on record is Silicon Labs' own Secondary CVSS v3.1 submission: 5.8 (medium), vector CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H — network-exploitable but requiring high attack complexity and high privileges, with impact limited to availability (no confidentiality or integrity loss) (NVD).

Siemens' CISA-republished advisory confirms the same CVSS v3.1 5.8 score for the SENTRON 3NA COM Fuse specifically, lists the affected sectors as Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services and Government Services and Facilities with worldwide deployment, and credits Siemens ProductCERT itself with reporting the vulnerability to CISA. The fix is to update SENTRON 3NA COM Fuse to version 5.2 or later; Siemens' general recommendation beyond the patch is to protect network access to the devices and operate them in a protected IT environment per its standard industrial-security operational guidelines (CISA ICS Advisory ICSA-26-295-05).

As of 2026-10-30, CVE-2024-7322 is not listed in the CISA Known Exploited Vulnerabilities catalog, and FIRST scores the probability of exploitation at 0.00341 (27.7th percentile) as of 2026-10-31 (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. SENTRON 3NA COM Fuse operators should update to version 5.2 or later and keep the device's Zigbee network isolated from untrusted wireless ranges in the meantime.

• A Zigbee coordinator, router or end device may change its node ID upon receiving an unsolicited encrypted rejoin response, causing a DoS that requires network re-establishment to recover (CWE-940). — NVD
• Originally scored by Silicon Labs as the Zigbee stack vendor; no NVD Primary score; only Secondary CVSS v3.1 5.8 (AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H) on record, submitted by [email protected]. — NVD
• Siemens' republished advisory applies the same CVSS v3.1 5.8 to SENTRON 3NA COM Fuse (bundled Zigbee stack); fix is to update to V5.2 or later; Siemens ProductCERT reported the issue to CISA itself. — Siemens Security Advisory SSA-099819
• Affects Critical Manufacturing, Transportation Systems, Energy, Healthcare and Public Health, Financial Services and Government Services and Facilities sectors worldwide; Siemens headquartered in Germany; CISA republished the advisory 2026-10-22. — CISA ICS Advisory ICSA-26-295-05
• Not present in the CISA KEV catalog as of 2026-10-30; EPSS score is 0.00341 (27.7th percentile) as of 2026-10-31. — FIRST EPSS