{"id":13313,"date":"2026-02-25T12:50:57","date_gmt":"2026-02-25T11:50:57","guid":{"rendered":"https:\/\/limessecurity.ninja\/?p=13313"},"modified":"2026-03-10T08:54:53","modified_gmt":"2026-03-10T07:54:53","slug":"siemens-healthineers-syngo-plaza-vulnerability","status":"publish","type":"post","link":"https:\/\/limessecurity.com\/de\/siemens-healthineers-syngo-plaza-vulnerability\/","title":{"rendered":"Siemens Healthineers syngo.plaza – Sicherheitsl\u00fccke in Passwortverschl\u00fcsselung"},"content":{"rendered":"[vc_row type=“in_container“ full_screen_row_position=“middle“ column_margin=“default“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ scene_position=“center“ text_color=“dark“ text_align=“left“ row_border_radius=“none“ row_border_radius_applies=“bg“ overflow=“visible“ overlay_strength=“0.3″ gradient_direction=“left_to_right“ shape_divider_position=“bottom“ bg_image_animation=“none“][vc_column column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ column_position=“default“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“1\/1″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“][vc_column_text css=““ text_direction=“default“]Im Rahmen eines Security Assessments haben wir eine Sicherheitsl\u00fccke in der Passwortverschl\u00fcsselung (CVE-2024-52334<\/a>) in Siemens Healthineers syngo.plaza VB30E entdeckt – einem in Krankenh\u00e4usern eingesetzten Archivierungssystem f\u00fcr medizinische Bilddaten. Die Sicherheitsl\u00fccke erm\u00f6glicht es einem Angreifer, Original-Passw\u00f6rter aus unzureichend verschl\u00fcsselten Speichern mit einem statischen Schl\u00fcssel wiederherzustellen und sich so m\u00f6glicherweise unbefugten Zugriff auf medizinische Daten zu verschaffen.[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=“in_container“ full_screen_row_position=“middle“ column_margin=“default“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ scene_position=“center“ top_padding=“1%“ bottom_padding=“1%“ text_color=“dark“ text_align=“left“ row_border_radius=“none“ row_border_radius_applies=“bg“ overflow=“visible“ overlay_strength=“0.3″ gradient_direction=“left_to_right“ shape_divider_position=“bottom“ bg_image_animation=“none“ gradient_type=“default“ shape_type=““][vc_column column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ column_position=“default“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“1\/1″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“][vc_column_text css=““ text_direction=“default“]\n

Entdeckte Sicherheitsl\u00fccke<\/span><\/span><\/h2>\n[\/vc_column_text][divider line_type=“No Line“][vc_row_inner equal_height=“yes“ content_placement=“top“ column_margin=“default“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ text_align=“center“ row_position=“default“ row_position_tablet=“inherit“ row_position_phone=“inherit“ overflow=“visible“ pointer_events=“all“][vc_column_inner column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ top_margin=“0″ constrain_group_1=“yes“ bottom_margin=“0″ left_margin=“0″ constrain_group_2=“yes“ right_margin=“0″ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ overflow=“visible“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“1\/3″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“ column_padding_type=“default“ gradient_type=“default“][vc_pie value=“63″ label_value=“6.3″ color=“#9e1510″ css=“.vc_custom_1772026551380{background-position: center !important;background-repeat: no-repeat !important;background-size: cover !important;}“ el_id=“orangePieChart“ title=“CVSS v4.0 Score“ units=“\/medi“][\/vc_column_inner][vc_column_inner column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ centered_text=“true“ desktop_text_alignment=“left“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ overflow=“visible“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“2\/3″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“ column_padding_type=“default“ gradient_type=“default“][nectar_icon_list color=“default“ direction=“vertical“ icon_size=“small“ icon_style=“border“][nectar_icon_list_item icon_type=“icon“ text_full_html=“simple“ title=“List Item“ id=“1772102386769-8″ icon_fontawesome=“fa fa-thumb-tack“ header=“Produkt:“ text=“syngo.plaza VB30E“ tab_id=“1772102386770-8″][\/nectar_icon_list_item][nectar_icon_list_item icon_type=“icon“ text_full_html=“simple“ title=“List Item“ id=“1772102386779-7″ icon_fontawesome=“fa fa-thumb-tack“ header=“Betroffene Versionen:“ text=“all versions < VB30E_HF07″ tab_id=“1772102386780-3″][\/nectar_icon_list_item][nectar_icon_list_item icon_type=“icon“ text_full_html=“html“ title=“List Item“ id=“1772102386786-2″ icon_fontawesome=“fa fa-thumb-tack“ header=“CVE \/ Vendor ID:“ tab_id=“1772102386786-3″]CVE-2024-52334<\/a>[\/nectar_icon_list_item][nectar_icon_list_item icon_type=“icon“ text_full_html=“simple“ title=“List Item“ id=“1772102386790-9″ icon_fontawesome=“fa fa-thumb-tack“ header=“Gefunden von:“ text=“Felix Eberstaller & Bernhard Lorenz, Limes Security GmbH“ tab_id=“1772102386790-1″][\/nectar_icon_list_item][\/nectar_icon_list][\/vc_column_inner][\/vc_row_inner][nectar_btn size=“small“ button_style=“regular“ button_color_2=“Accent-Color“ icon_family=“none“ text=“CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N“ url=“https:\/\/www.first.org\/cvss\/calculator\/4.0#CVSS:4.0\/AV:N\/AC:L\/AT:P\/PR:N\/UI:N\/VC:L\/VI:N\/VA:N\/SC:N\/SI:N\/SA:N“][divider line_type=“Small Line“ line_alignment=“center“ line_thickness=“1″ divider_color=“default“][\/vc_column][\/vc_row][vc_row type=“in_container“ full_screen_row_position=“middle“ column_margin=“default“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ scene_position=“center“ text_color=“dark“ text_align=“left“ row_border_radius=“none“ row_border_radius_applies=“bg“ overflow=“visible“ overlay_strength=“0.3″ gradient_direction=“left_to_right“ shape_divider_position=“bottom“ bg_image_animation=“none“][vc_column column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ column_position=“default“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“1\/1″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“][vc_column_text css=““ text_direction=“default“]\n

Die Schwachstelle: <\/span><\/span>Schwache Passwortverschl\u00fcsselung in syngo.plaza<\/h2>\n

Die Schwachstelle wird als CWE-261<\/a> (schwache Verschl\u00fcsselung f\u00fcr Passw\u00f6rter) klassifiziert. syngo.plaza hat gespeicherte Passw\u00f6rter nicht ordnungsgem\u00e4\u00df verschl\u00fcsselt, sodass ein Angreifer mit Zugriff auf die entsprechenden Daten Klartext-Anmeldedaten wiederherstellen konnte.<\/p>\n

Wir haben die Schwachstelle im Rahmen einer koordinierten Offenlegung gemeldet, und Siemens Healthineers hat sie mit einem Hotfix behoben.<\/p>\n

Siemens Healthineers Security Advisory:<\/span><\/b>\u00a0<\/span>SSA-016040<\/span><\/a>\u00a0<\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=“in_container“ full_screen_row_position=“middle“ column_margin=“default“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ scene_position=“center“ text_color=“dark“ text_align=“left“ row_border_radius=“none“ row_border_radius_applies=“bg“ overflow=“visible“ overlay_strength=“0.3″ gradient_direction=“left_to_right“ shape_divider_position=“bottom“ bg_image_animation=“none“][vc_column column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ column_position=“default“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“1\/1″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“][divider line_type=“No Line“ custom_height=“30″]\n

Ein Muster, keine Anomalie<\/strong><\/h2>\n

Diese Erkenntnis \u00fcberraschte uns nicht. Statische Passw\u00f6rter, fest codierte Schl\u00fcssel und unzureichende kryptografische Schutzma\u00dfnahmen sind seit mehr als zwei Jahrzehnten ein Dauerproblem bei OT-Produkten. Das Problem beschr\u00e4nkt sich nicht auf einen einzelnen Anbieter oder Sektor, sondern ist ein branchenweites Muster, das in historischen Designentscheidungen und den besonderen Einschr\u00e4nkungen dieser Umgebungen begr\u00fcndet ist.[\/vc_column_text][divider line_type=“No Line“ custom_height=“40px“][vc_column_text css=““ text_direction=“default“]\n

Unsere Empfehlung<\/strong><\/h2>\n

Betreiber betroffener Systeme sollten unbedingt den Hotfix f\u00fcr syngo.plaza (VB30E_HF07) gem\u00e4\u00df der Empfehlung SSA-016040 von Siemens Healthineers anwenden. Dar\u00fcber hinaus empfehlen wir die regelm\u00e4\u00dfige Durchf\u00fchrung von Penetration Tests<\/a>.<\/p>\n

Hersteller sollten hardcoded Zugangsdaten entfernen und die Produktsicherheit gem\u00e4\u00df regulatorischer Vorgaben ganzheitlich \u00fcber den gesamten Lebenszyklus integrieren.[\/vc_column_text][divider line_type=“No Line“ custom_height=“40px“][\/vc_column][\/vc_row][vc_row type=“in_container“ full_screen_row_position=“middle“ column_margin=“default“ equal_height=“yes“ content_placement=“middle“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ bg_color=“#efefef“ scene_position=“center“ text_color=“dark“ text_align=“left“ row_border_radius=“none“ row_border_radius_applies=“bg“ overflow=“visible“ overlay_strength=“0.3″ gradient_direction=“left_to_right“ shape_divider_position=“bottom“ bg_image_animation=“none“ gradient_type=“default“ shape_type=““][vc_column column_padding=“padding-3-percent“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“ column_border_radius=“none“ column_link_target=“_self“ column_position=“default“ gradient_direction=“left_to_right“ overlay_strength=“0.3″ width=“1\/2″ tablet_width_inherit=“default“ animation_type=“default“ bg_image_animation=“none“ border_type=“simple“ column_border_width=“none“ column_border_style=“solid“ column_padding_type=“default“ gradient_type=“default“][vc_column_text css=““ text_direction=“default“]\n","protected":false},"excerpt":{"rendered":"

[vc_row type=“in_container“ full_screen_row_position=“middle“ column_margin=“default“ column_direction=“default“ column_direction_tablet=“default“ column_direction_phone=“default“ scene_position=“center“ text_color=“dark“ text_align=“left“ row_border_radius=“none“ row_border_radius_applies=“bg“ overflow=“visible“ overlay_strength=“0.3″ gradient_direction=“left_to_right“ shape_divider_position=“bottom“ bg_image_animation=“none“][vc_column column_padding=“no-extra-padding“ column_padding_tablet=“inherit“ column_padding_phone=“inherit“ column_padding_position=“all“ column_element_direction_desktop=“default“ column_element_spacing=“default“ desktop_text_alignment=“default“ tablet_text_alignment=“default“ phone_text_alignment=“default“ background_color_opacity=“1″ background_hover_color_opacity=“1″ column_backdrop_filter=“none“ column_shadow=“none“…<\/p>\n","protected":false},"author":5,"featured_media":14687,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[281],"tags":[],"class_list":{"0":"post-13313","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-advisories"},"_links":{"self":[{"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/posts\/13313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/comments?post=13313"}],"version-history":[{"count":0,"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/posts\/13313\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/media\/14687"}],"wp:attachment":[{"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/media?parent=13313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/categories?post=13313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/limessecurity.com\/de\/wp-json\/wp\/v2\/tags?post=13313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}