1. EXECUTIVE SUMMARY

​CVSS v3 6.8
​ATTENTION: Low attack complexity
​Vendor: Trane
​Equipment: XL824, XL850, XL1050, and Pivot thermostats
​Vulnerability: Injection

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as root using a specially crafted filename.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​Trane reports this vulnerability affects the following thermostats:

​Trane Technologies XL824 Thermostat: Firmware versions 5.9.8 and earlier
​Trane Technologies XL850 Thermostat: Firmware versions 5.9.8 and earlier 
​Trane Technologies XL1050 Thermostat: Firmware versions 5.9.8 and earlier
​Trane Technologies Pivot Thermostat: Firmware versions 1.8 and earlier

3.2 VULNERABILITY OVERVIEW

3.2.1 ​INJECTION CWE-74

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

​CVE-2023-4212 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Ireland

3.4 RESEARCHER

​Houlton McGuinn reported this vulnerability to Trane.

4. MITIGATIONS

​Trane Technologies has pushed the patch out to all devices. The patch is available to all affected devices. As soon as the device is connected to the internet, it will check for a new firmware version. If a new version is available, the device will download and install it. Other than connecting the device to the internet, no user interaction is required.

​If a user wants to verify that they received a patch for this vulnerability, they can verify the firmware version is greater than what is listed above by navigating to the “About” screen on the thermostat. Menu > System Info > About.

​For more information, users may contact their local Trane sales office.

​Trane has published a service database article on their website (login required).

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

1. EXECUTIVE SUMMARY

CVSS v3 9.8
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Rockwell Automation
Equipment: ThinManager ThinServer
Vulnerabilities: Improper Input Validation

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow an attacker to remotely delete arbitrary files with system privileges.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Rockwell Automation reports this vulnerability affects the following versions of ThinManager ThinServer, a thin client and remote desktop protocol (RDP) server management software:

ThinManager ThinServer: Versions 11.0.0-11.0.6
ThinManager ThinServer: Versions 11.1.0-11.1.6
ThinManager ThinServer: Versions 11.2.0-11.2.6
ThinManager ThinServer: Versions 12.1.0-12.1.6
ThinManager ThinServer: Versions 12.0.0-12.0.5
ThinManager ThinServer: Versions 13.0.0-13.0.2
ThinManager ThinServer: Version 13.1.0

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER INPUT VALIDATION CWE-20

Due to improper input validation, an integer overflow condition exists in the affected products. When the ThinManager processes incoming messages, a read access violation occurs and terminates the process. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message.

CVE-2023-2914 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.2 IMPROPER INPUT VALIDATION CWE-20

Due to improper input validation, a path traversal vulnerability exists when the ThinManager processes a certain function. If exploited, an unauthenticated remote threat actor can delete arbitrary files with system privileges. A malicious user could exploit this vulnerability by sending a specifically crafted synchronization protocol message.

CVE-2023-2915 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.3 IMPROPER INPUT VALIDATION CWE-20

Due to improper input validation, a path traversal vulnerability exists, via the file name field, when the ThinManager processes a certain function. If exploited, an unauthenticated remote attacker can upload arbitrary files to any directory on the disk drive where ThinServer.exe is installed. A malicious user could exploit this vulnerability by sending a crafted synchronization protocol message.

CVE-2023-2917 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: United States

3.4 RESEARCHER

Rockwell Automation reported these vulnerabilities to CISA.

4. MITIGATIONS

Rockwell Automation recommends customers apply the following mitigations:

ThinManager ThinServer: Versions 11.0.0-11.2.6: Update to 11.0.7
ThinManager ThinServer: Versions 11.1.0-11.1.6: Update to 11.1.7
ThinManager ThinServer: Versions 11.2.0-11.2.6: Update to 11.2.8
ThinManager ThinServer: Versions 12.1.0-12.1.6: Update to 12.1.7
ThinManager ThinServer: Versions 12.0.0-12.0.5: Update to 12.0.6
ThinManager ThinServer: Versions 13.0.0-13.0.2: Update to 13.0.3
ThinManager ThinServer: Version 13.1.0: Update to 13.1.1

Customers using the affected software are encouraged to apply mitigations, if possible. Additionally, Rockwell Automation encourages customers to implement suggested security best practices to minimize the risk of vulnerability.

Update to the corrected software versions.
Limit remote access for TCP Port 2031 to known thin clients and ThinManager servers.
Security Best Practices

For more information, see Rockwell Automation’s Security Advisory.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time.

1. EXECUTIVE SUMMARY

CVSS v3 3.3 
ATTENTION: low attack complexity 
Vendor: CODESYS, GmbH 
Equipment: CODESYS Development System 
Vulnerability: Improper Restriction of Excessive Authentication Attempts. 

2. RISK EVALUATION

Successful exploitation of this vulnerability could provide a local attacker with account information. 

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

CODESYS reports this vulnerability affects the following versions of CODESYS Development System: 

CODESYS Development System: versions prior to 3.5.19.20 

3.2 VULNERABILITY OVERVIEW

3.2.1 INSUFFICIENT VERIFICATION OF DATA AUTHENTICITY CWE-345 

A missing brute-force protection in CODESYS Development System prior to 3.5.19.20 could allow a local attacker to have unlimited attempts of guessing the password within an import dialog. 

CVE-2023-3669 has been assigned to this vulnerability. A CVSS v3 base score of 3.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). 

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing 
COUNTRIES/AREAS DEPLOYED: Worldwide 
COMPANY HEADQUARTERS LOCATION: Germany 

3.4 RESEARCHER

A user reported this vulnerability. CERT@VDE coordinated the vulnerability. 

4. MITIGATIONS

CODESYS recommends users update the CODESYS Development System to version 3.5.19.20. 

The CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. 

Alternatively, users may find further information on obtaining the software update in the CODESYS Update area. 

For more information, please see the advisory CERT@VDE published for CODESYS at: 

https://cert.vde.com/en-us/advisories/vde-2023-023 

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. 

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. 

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies. 

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. 

CISA also recommends users take the following measures to protect themselves from social engineering attacks: 

Do not click web links or open attachments in unsolicited email messages. 
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. 
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. 

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. 

1. EXECUTIVE SUMMARY

​CVSS v3 8.6 
​ATTENTION: Exploitable remotely/low attack complexity 
​Vendor: Rockwell Automation  
​Equipment: 1734-AENT/1734-AENTR Series C, 1734-AENT/1734-AENTR Series B, 1738-AENT/ 1738-AENTR Series B, 1794-AENTR Series A, 1732E-16CFGM12QCWR Series A, 1732E-12X4M12QCDR Series A, 1732E-16CFGM12QCR Series A, 1732E-16CFGM12P5QCR Series A, 1732E-12X4M12P5QCDR Series A, 1732E-16CFGM12P5QCWR Series B, 1732E-IB16M12R Series B, 1732E-OB16M12R Series B, 1732E-16CFGM12R Series B, 1732E-IB16M12DR Series B, 1732E-OB16M12DR Series B, 1732E-8X8M12DR Series B, 1799ER-IQ10XOQ10 Series B 
​Vulnerability: Out-of-Bounds Write 

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service on the affected products.  

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following versions of select Input/Output Modules from Rockwell Automation are affected: 

​1734-AENT/1734-AENTR Series C: Versions 7.011 and prior  
​1734-AENT/1734-AENTR Series B: Versions 5.019 and prior  
​1738-AENT/ 1738-AENTR Series B: Versions 6.011 and prior  
​1794-AENTR Series A: Versions 2.011 and prior  
​1732E-16CFGM12QCWR Series A: Versions 3.011 and prior 
​1732E-12X4M12QCDR Series A: Versions 3.011 and prior  
​1732E-16CFGM12QCR Series A: Versions 3.011 and prior  
​1732E-16CFGM12P5QCR Series A: Versions 3.011 and prior  
​1732E-12X4M12P5QCDR Series A: Versions 3.011 and prior 
​1732E-16CFGM12P5QCWR Series B: Versions 3.011 and prior  
​1732E-IB16M12R Series B: Versions 3.011 and prior  
​1732E-OB16M12R Series B: Versions 3.011 and prior  
​1732E-16CFGM12R Series B: Versions 3.011 and prior  
​1732E-IB16M12DR Series B: Versions 3.011 and prior  
​1732E-OB16M12DR Series B: Versions 3.011 and prior  
​1732E-8X8M12DR Series B: Versions 3.011 and prior 
​1799ER-IQ10XOQ10 Series B: Versions 3.011 and prior  

3.2 VULNERABILITY OVERVIEW

3.2.1 ​OUT-OF-BOUNDS WRITE CWE-787 

​Pyramid Solutions’ affected products, the Developer and DLL kits for EtherNet/IP Adapter and EtherNet/IP Scanner may be vulnerable to an out-of-bounds write, which may allow an unauthorized threat actor to send a specially crafted packet that may result in a denial-of-service condition. 

​CVE-2022-1737 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H). 

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing 
​COUNTRIES/AREAS DEPLOYED: Worldwide 
​COMPANY HEADQUARTERS LOCATION: United States 

3.4 RESEARCHER

​Rockwell Automation reported this vulnerability to CISA. 

4. MITIGATIONS

​Rockwell Automation has released and recommends users apply the following mitigations: 

​1734-AENT/1734-AENTR Series C: Versions 7.011 and prior. Upgrade to 7.013 
​1734-AENT/1734-AENTR Series B: Versions 5.019 and prior. Upgrade to 5.021  
​1738-AENT/ 1738-AENTR Series B: Versions 6.011 and prior. Upgrade to 6.013  
​1794-AENTR Series A: Versions 2.011 and prior. Upgrade to 2.012  
​1732E-16CFGM12QCWR Series A: Versions 3.011 and prior. Upgrade to 3.012 
​1732E-12X4M12QCDR Series A: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-16CFGM12QCR Series A: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-16CFGM12P5QCR Series A: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-12X4M12P5QCDR Series A: Versions 3.011 and prior. Upgrade to 3.012 
​1732E-16CFGM12P5QCWR Series B: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-IB16M12R Series B: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-OB16M12R Series B: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-16CFGM12R Series B: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-IB16M12DR Series B: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-OB16M12DR Series B: Versions 3.011 and prior. Upgrade to 3.012  
​1732E-8X8M12DR Series B: Versions 3.011 and prior. Upgrade to 3.012 
​1799ER-IQ10XOQ10 Series B: Versions 3.011 and prior. Upgrade to 3.012 

​Rockwell Automation encourages users of the affected software to apply the risk mitigations below, if possible. Additionally, users are encouraged to implement suggested security best practices to minimize the risk of vulnerability. 

​Users should upgrade to the corrected firmware to mitigate the issues:

​Security best practices 

​For more information, see Rockwell Automation’s Security Advisory. 

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. 

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. 

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies. 

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. 

​No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.  

1. EXECUTIVE SUMMARY

CVSS v3 7.5 
ATTENTION: Exploitable remotely/low attack complexity/known public exploitation 
Vendor: KNX Association 
Equipment: KNX devices using KNX Connection Authorization 
Vulnerability: Overly Restrictive Account Lockout Mechanism 

2. RISK EVALUATION

Successful exploitation of this vulnerability could cause users to lose access to their device, potentially with no way to reset the device. 

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following devices using KNX Protocol are affected: 

KNX devices using Connection Authorization Option 1 Style in which no BCU Key is currently set: All versions 

3.2 VULNERABILITY OVERVIEW

3.2.1 OVERLY RESTRICTIVE ACCOUNT LOCKOUT MECHANISM CWE-645 

KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way. 

CVE-2023-4346 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). 

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing Sector
COUNTRIES/AREAS DEPLOYED: Europe 
COMPANY HEADQUARTERS LOCATION: Belgium 

3.4 RESEARCHER

Felix Eberstaller reported this vulnerability to CISA. 

4. MITIGATIONS

KNX Association recommends all system integrators, installers, ETS users, and end customers to follow common IT security guidelines. KNX Association recommends users follow the recommendations in the KNX Secure Checklist. 

The KNX Association also recommends developers always set the BCU Key in every KNX Project that is already finished and will be commissioned in the future. Handover the BCU Key as part of the Project Documentation to the Building Owner. 

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: 

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet. 
Locate control system networks and remote devices behind firewalls and isolate them from business networks. 
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. 

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. 

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. 

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies. 

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. 

CISA has received reports of this vulnerability being actively exploited. 

1. EXECUTIVE SUMMARY

​CVSS v3 7.3 
​ATTENTION: low attack complexity 
​Vendor: CODESYS, GmbH 
​Equipment: CODESYS Development System 
​Vulnerability: Uncontrolled Search Path Element. 

2. RISK EVALUATION

​Successful exploitation of this vulnerability could cause users to unknowingly launch a malicious binary placed by a local attacker. 

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​CODESYS reports this vulnerability affects the following versions of CODESYS Development System: 

​CODESYS Development System: versions from 3.5.17.0 and prior to 3.5.19.20 

3.2 VULNERABILITY OVERVIEW

3.2.1 ​UNCONTROLLED SEARCH PATH ELEMENT CWE-427 

​In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory in the users’ context. 

​CVE-2023-3662 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). 

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing 
​COUNTRIES/AREAS DEPLOYED: Worldwide 
​COMPANY HEADQUARTERS LOCATION: Germany 

3.4 RESEARCHER

​Carlo Di Dato of Deloitte Risk Advisory Italia – Vulnerability Research Team reported this vulnerability. CERT@VDE coordinated the vulnerability. 

4. MITIGATIONS

ODESYS recommends users update the CODESYS Development System to version 3.5.19.20. 

​The CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. 

​Alternatively, users may find further information on obtaining the software update in the CODESYS Update area. 

​For more information, please see the advisory CERT@VDE published for CODESYS at: 

​https://cert.vde.com/en-us/advisories/vde-2023-021 

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: 

​Exercise principles of least privilege. 

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. 

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. 

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies. 

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. 

​CISA also recommends users take the following measures to protect themselves from social engineering attacks: 

​Do not click web links or open attachments in unsolicited email messages. 
​Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. 
​Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. 

​No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. 

1. EXECUTIVE SUMMARY

CVSS v3 9.6
ATTENTION: Exploitable remotely/low attack complexity 
Vendor: CODESYS, GmbH 
Equipment: CODESYS Development System 
Vulnerability: Insufficient Verification of Data Authenticity. 

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute a-man-in-the-middle (MITM) attack to execute arbitrary code. 

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

CODESYS reports this vulnerability affects the following versions of CODESYS Development System: 

CODESYS Development System: versions from 3.5.11.0 and prior to 3.5.19.20 

3.2 VULNERABILITY OVERVIEW

3.2.1 INSUFFICIENT VERIFICATION OF DATA AUTHENTICITY CWE-345 

In CODESYS Development System versions from 3.5.11.0 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server. 

CVE-2023-3663 has been assigned to this vulnerability. A CVSS v3 base score of 9.6 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). 

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing 
COUNTRIES/AREAS DEPLOYED: Worldwide 
COMPANY HEADQUARTERS LOCATION: Germany 

3.4 RESEARCHER

Sina Kheirkhah of Summoning Team working with Trend Micro Zero Day Initiative reported this vulnerability. CERT@VDE coordinated the vulnerability. 

4. MITIGATIONS

CODESYS recommends users update the CODESYS Development System to version 3.5.19.20. 

The CODESYS Development System can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. 

Alternatively, users may find further information on obtaining the software update in the CODESYS Update area. 

For more information, please see the advisory CERT@VDE published for CODESYS at: 

https://cert.vde.com/en-us/advisories/vde-2023-022 

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: 

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet. 
Locate control system networks and remote devices behind firewalls and isolate them from business networks. 
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. 

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. 

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. 

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies. 

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. 

CISA also recommends users take the following measures to protect themselves from social engineering attacks: 

Do not click web links or open attachments in unsolicited email messages. 
Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. 
Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. 

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. 

1. EXECUTIVE SUMMARY

​CVSS v3 7.5 
​ATTENTION: Exploitable remotely/low attack complexity 
​Vendor: OPTO 22 
​Equipment: SNAP PAC S1 
​Vulnerabilities: Improper Restriction of Excessive Authentication Attempts, Weak Password Requirements, Improper Access Control, Uncontrolled Resource Consumption 

2. RISK EVALUATION

​Successful exploitation of these vulnerabilities could allow an attacker to brute force passwords, access certain device files, or cause a denial-of-service condition. 

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following version of SNAP PAC S1, an industrial programmable automation controller, is affected: 

​SNAP PAC S1 Firmware: Version R10.3b 

3.2 VULNERABILITY OVERVIEW

3.2.1 ​IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307 

​There is no limit on the number of login attempts. This could allow a brute force attack on the built-in web server login. 

​CVE-2023-40706 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). 

3.2.2 ​WEAK PASSWORD REQUIREMENTS CWE-521 

​There are no requirements for setting a complex password, which could allow a successful brute force attack if users don’t setup complex credentials. 

​CVE-2023-40707 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). 

3.2.3 ​IMPROPER ACCESS CONTROL CWE-284 

​The File Transfer Protocol (FTP) port is open by default. This could allow an adversary to access some device files. 

​CVE-2023-40708 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). 

3.2.4 UNCONTROLLED RESOURCE CONSUMPTION CWE-400 

​An adversary could crash the entire device by sending large quantity of ICMP requests if the controller has the built-in web server enabled but not completely set-up and configured. 

​CVE-2023-40709 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). 

3.2.5 ​UNCONTROLLED RESOURCE CONSUMPTION CWE-400 

​An adversary could cause a continuous restart loop to the entire device by sending large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set-up and configured. 

​CVE-2023-40710 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been assigned; the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). 

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing 
​COUNTRIES/AREAS DEPLOYED: Worldwide 
​COMPANY HEADQUARTERS LOCATION: United States 

3.4 RESEARCHER

​Nicolas Cano of Dragos reported these vulnerabilities to CISA. 

4. MITIGATIONS

​OPTO 22 recommends users follow the direction Dragos and CISA provided for this vulnerability. 

​Dragos recommends users take the following actions: 

​Disable the built-in web server when not in use through the Network Security settings within the OPTO 22 Pac Manager software. 
​Restrict access to the built-in web server found on HTTPS (TCP/443). 
​Restrict access to the FTP Port (TCP/21). 
​Ensure user credentials are changed to something long, complex, and unique. 

​CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should: 

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet. 
​Locate control system networks and remote devices behind firewalls and isolate them from business networks. 
​When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices. 

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. 

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. 

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies. 

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. 

​No known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time. 

1. EXECUTIVE SUMMARY

CVSS v3 9.1 
ATTENTION: Exploitable remotely / low attack complexity  
Vendor: Siemens  
Equipment: RUGGEDCOM 
Vulnerability: Incorrect Provision of Specified Functionality 

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to inject information into the network via the mirror port.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following products from Siemens are affected:

RUGGEDCOM i800: All versions prior to V4.3.8
RUGGEDCOM i800NC: All versions prior to V4.3.8
RUGGEDCOM i801: All versions prior to V4.3.8
RUGGEDCOM i801NC: All versions prior to V4.3.8
RUGGEDCOM i802: All versions prior to V4.3.8
RUGGEDCOM i802NC: All versions prior to V4.3.8
RUGGEDCOM i803: All versions prior to V4.3.8
RUGGEDCOM i803NC: All versions prior to V4.3.8
RUGGEDCOM M2100: All versions prior to V4.3.8
RUGGEDCOM M2100F: All versions
RUGGEDCOM M2100NC: All versions prior to V4.3.8
RUGGEDCOM M2200: All versions prior to V4.3.8
RUGGEDCOM M2200F: All versions
RUGGEDCOM M2200NC: All versions prior to V4.3.8
RUGGEDCOM M969: All versions prior to V4.3.8
RUGGEDCOM M969F: All versions
RUGGEDCOM M969NC: All versions prior to V4.3.8
RUGGEDCOM RMC30: All versions prior to V4.3.8
RUGGEDCOM RMC30NC: All versions prior to V4.3.8
RUGGEDCOM RMC8388 V4.X: All versions prior to V4.3.8
RUGGEDCOM RMC8388 V5.X: All versions
RUGGEDCOM RMC8388NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RMC8388NC V5.X: All versions
RUGGEDCOM RP110: All versions prior to V4.3.8
RUGGEDCOM RP110NC: All versions prior to V4.3.8
RUGGEDCOM RS1600: All versions
RUGGEDCOM RS1600F: All versions
RUGGEDCOM RS1600FNC: All versions
RUGGEDCOM RS1600NC: All versions
RUGGEDCOM RS1600T: All versions
RUGGEDCOM RS1600TNC: All versions
RUGGEDCOM RS400: All versions
RUGGEDCOM RS400F: All versions
RUGGEDCOM RS400NC: All versions
RUGGEDCOM RS401: All versions
RUGGEDCOM RS401NC: All versions
RUGGEDCOM RS416: All versions prior to V4.3.8
RUGGEDCOM RS416F: All versions
RUGGEDCOM RS416NC: All versions prior to V4.3.8
RUGGEDCOM RS416NC v2: All versions
RUGGEDCOM RS416P: All versions prior to V4.3.8
RUGGEDCOM RS416PF: All versions
RUGGEDCOM RS416PNC: All versions prior to V4.3.8
RUGGEDCOM RS416PNC v2: All versions
RUGGEDCOM RS416Pv2: All versions
RUGGEDCOM RS416v2: All versions
RUGGEDCOM RS8000: All versions
RUGGEDCOM RS8000A: All versions
RUGGEDCOM RS8000ANC: All versions
RUGGEDCOM RS8000H: All versions
RUGGEDCOM RS8000HNC: All versions
RUGGEDCOM RS8000NC: All versions
RUGGEDCOM RS8000T: All versions
RUGGEDCOM RS8000TNC: All versions
RUGGEDCOM RS900: All versions prior to V4.3.8
RUGGEDCOM RS900: All versions with switch chip M88E6083
RUGGEDCOM RS900 (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900 (32M) V5.X: All versions
RUGGEDCOM RS900F: All versions
RUGGEDCOM RS900G: All versions prior to V4.3.8
RUGGEDCOM RS900G (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900G (32M) V5.X: All versions
RUGGEDCOM RS900GF: All versions
RUGGEDCOM RS900GNC: All versions prior to V4.3.8
RUGGEDCOM RS900GNC(32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900GNC(32M) V5.X: All versions
RUGGEDCOM RS900GP: All versions prior to V4.3.8
RUGGEDCOM RS900GPF: All versions
RUGGEDCOM RS900GPNC: All versions prior to V4.3.8
RUGGEDCOM RS900L: All versions prior to V4.3.8
RUGGEDCOM RS900L: All versions
RUGGEDCOM RS900LNC: All versions prior to V4.3.8
RUGGEDCOM RS900LNC: All versions
RUGGEDCOM RS900M-GETS-C01: All versions prior to V4.3.8
RUGGEDCOM RS900M-GETS-XX: All versions prior to V4.3.8
RUGGEDCOM RS900M-STND-C01: All versions prior to V4.3.8
RUGGEDCOM RS900M-STND-XX: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-GETS-C01: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-GETS-XX: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-STND-XX: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-STND-XX-C01: All versions prior to V4.3.8
RUGGEDCOM RS900NC: All versions prior to V4.3.8
RUGGEDCOM RS900NC: All versions
RUGGEDCOM RS900NC(32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900NC(32M) V5.X: All versions
RUGGEDCOM RS900W: All versions prior to V4.3.8
RUGGEDCOM RS910: All versions prior to V4.3.8
RUGGEDCOM RS910L: All versions prior to V4.3.8
RUGGEDCOM RS910LNC: All versions prior to V4.3.8
RUGGEDCOM RS910NC: All versions prior to V4.3.8
RUGGEDCOM RS910W: All versions prior to V4.3.8
RUGGEDCOM RS920L: All versions prior to V4.3.8
RUGGEDCOM RS920LNC: All versions prior to V4.3.8
RUGGEDCOM RS920W: All versions prior to V4.3.8
RUGGEDCOM RS930L: All versions prior to V4.3.8
RUGGEDCOM RS930LNC: All versions prior to V4.3.8
RUGGEDCOM RS930W: All versions prior to V4.3.8
RUGGEDCOM RS940G: All versions prior to V4.3.8
RUGGEDCOM RS940GF: All versions
RUGGEDCOM RS940GNC: All versions prior to V4.3.8
RUGGEDCOM RS969: All versions prior to V4.3.8
RUGGEDCOM RS969NC: All versions prior to V4.3.8
RUGGEDCOM RSG2100: All versions prior to V4.3.8
RUGGEDCOM RSG2100 (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2100 (32M) V5.X: All versions
RUGGEDCOM RSG2100F: All versions
RUGGEDCOM RSG2100NC: All versions prior to V4.3.8
RUGGEDCOM RSG2100NC(32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2100NC(32M) V5.X: All versions
RUGGEDCOM RSG2100P: All versions prior to V4.3.8
RUGGEDCOM RSG2100PF: All versions
RUGGEDCOM RSG2100PNC: All versions prior to V4.3.8
RUGGEDCOM RSG2200: All versions prior to V4.3.8
RUGGEDCOM RSG2200F: All versions
RUGGEDCOM RSG2200NC: All versions prior to V4.3.8
RUGGEDCOM RSG2288 V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2288 V5.X: All versions
RUGGEDCOM RSG2288NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2288NC V5.X: All versions
RUGGEDCOM RSG2300 V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300 V5.X: All versions
RUGGEDCOM RSG2300F: All versions
RUGGEDCOM RSG2300NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300NC V5.X: All versions
RUGGEDCOM RSG2300P V4.X: All versions prior to V4.3.8 
RUGGEDCOM RSG2300P V5.X: All versions
RUGGEDCOM RSG2300PF: All versions
RUGGEDCOM RSG2300PNC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300PNC V5.X: All versions
RUGGEDCOM RSG2488 V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2488 V5.X: All versions
RUGGEDCOM RSG2488F: All versions
RUGGEDCOM RSG2488NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2488NC V5.X: All versions
RUGGEDCOM RSG907R: All versions
RUGGEDCOM RSG908C: All versions
RUGGEDCOM RSG909R: All versions
RUGGEDCOM RSG910C: All versions
RUGGEDCOM RSG920P V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG920P V5.X: All versions
RUGGEDCOM RSG920PNC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG920PNC V5.X: All versions
RUGGEDCOM RSL910: All versions
RUGGEDCOM RSL910NC: All versions
RUGGEDCOM RST2228: All versions
RUGGEDCOM RST2228P: All versions
RUGGEDCOM RST916C: All versions
RUGGEDCOM RST916P: All version

3.2 VULNERABILITY OVERVIEW

3.2.1 INCORRECT PROVISION OF SPECIFIED FUNCTIONALITY CWE-684 

The affected products insufficiently block data from being forwarded over the mirror port into the mirrored network.  An attacker could use this behavior to transmit malicious packets to systems in the mirrored network, possibly influencing their configuration and runtime behavior.

CVE-2023-24845 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has released updates for several affected products and recommends updating to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available:

RUGGEDCOM i800: Update to V4.3.8 or later version
RUGGEDCOM i800NC: Update to V4.3.8 or later version
RUGGEDCOM i801: Update to V4.3.8 or later version
RUGGEDCOM i801NC: Update to V4.3.8 or later version
RUGGEDCOM i802: Update to V4.3.8 or later version
RUGGEDCOM i802NC: Update to V4.3.8 or later version
RUGGEDCOM i803: Update to V4.3.8 or later version
RUGGEDCOM i803NC: Update to V4.3.8 or later version
RUGGEDCOM M2100: Update to V4.3.8 or later version
RUGGEDCOM M2100F: Currently no fix is planned.
RUGGEDCOM M2100NC: Update to V4.3.8 or later version
RUGGEDCOM M2200: Update to V4.3.8 or later version
RUGGEDCOM M2200F: Currently no fix is planned.
RUGGEDCOM M2200NC: Update to V4.3.8 or later version
RUGGEDCOM M969: Update to V4.3.8 or later version
RUGGEDCOM M969F: Currently no fix is planned.
RUGGEDCOM M969NC: Update to V4.3.8 or later version
RUGGEDCOM RMC30: Update to V4.3.8 or later version
RUGGEDCOM RMC30NC: Update to V4.3.8 or later version
RUGGEDCOM RMC8388 V4.X: Update to V4.3.8 or later version
RUGGEDCOM RMC8388 V5.X: Currently no fix is available.
RUGGEDCOM RMC8388NC V4.X: Update to V4.3.8 or later version
RUGGEDCOM RMC8388NC V5.X: Currently no fix is available.
RUGGEDCOM RP110: Update to V4.3.8 or later version
RUGGEDCOM RP110NC: Update to V4.3.8 or later version
RUGGEDCOM RS1600: Currently no fix is planned.
RUGGEDCOM RS1600F: Currently no fix is planned.
RUGGEDCOM RS1600FNC: Currently no fix is planned.
RUGGEDCOM RS1600NC: Currently no fix is planned.
RUGGEDCOM RS1600T: Currently no fix is planned.
RUGGEDCOM RS1600TNC: Currently no fix is planned.
RUGGEDCOM RS400: Currently no fix is planned.
RUGGEDCOM RS400F: Currently no fix is planned.
RUGGEDCOM RS400NC: Currently no fix is planned.
RUGGEDCOM RS401: Currently no fix is planned.
RUGGEDCOM RS401NC: Currently no fix is planned.
RUGGEDCOM RS416: Update to V4.3.8 or later version
RUGGEDCOM RS416F: Currently no fix is planned.
RUGGEDCOM RS416NC: Update to V4.3.8 or later version
RUGGEDCOM RS416NC v2: Currently no fix is available.
RUGGEDCOM RS416P: Update to V4.3.8 or later version
RUGGEDCOM RS416PF: Currently no fix is planned.
RUGGEDCOM RS416PNC: Update to V4.3.8 or later version
RUGGEDCOM RS416PNC v2: Currently no fix is available.
RUGGEDCOM RS416Pv2: Currently no fix is available.
RUGGEDCOM RS416v2: Currently no fix is available.
RUGGEDCOM RS8000: Currently no fix is planned.
RUGGEDCOM RS8000A: Currently no fix is planned.
RUGGEDCOM RS8000ANC: Currently no fix is planned.
RUGGEDCOM RS8000H: Currently no fix is planned.
RUGGEDCOM RS8000HNC: Currently no fix is planned.
RUGGEDCOM RS8000NC: Currently no fix is planned.
RUGGEDCOM RS8000T: Currently no fix is planned.
RUGGEDCOM RS8000TNC: Currently no fix is planned.
RUGGEDCOM RS900: Update to V4.3.8 or later version
RUGGEDCOM RS900 with switch chip M88E6083: Currently no fix is planned.
RUGGEDCOM RS900 (32M) V4.X: Update to V4.3.8 or later version
RUGGEDCOM RS900 (32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900F: Currently no fix is planned.
RUGGEDCOM RS900G: Update to V4.3.8 or later version
RUGGEDCOM RS900G (32M) V4.X: Update to V4.3.8 or later version
RUGGEDCOM RS900G (32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900GF: Currently no fix is planned.
RUGGEDCOM RS900GNC: Update to V4.3.8 or later version
RUGGEDCOM RS900GNC(32M) V4.X: Update to V4.3.8 or later version
RUGGEDCOM RS900GNC(32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900GP: Update to V4.3.8 or later version
RUGGEDCOM RS900GPF: Currently no fix is planned.
RUGGEDCOM RS900GPNC: Update to V4.3.8 or later version
RUGGEDCOM RS900L: Update to V4.3.8 or later version
RUGGEDCOM RS900L with switch chip M88E6083: Currently no fix is planned.
RUGGEDCOM RS900LNC: Update to V4.3.8 or later version
RUGGEDCOM RS900LNC with switch chip M88E6083: Currently no fix is planned.
RUGGEDCOM RS900M-GETS-C01: Update to V4.3.8 or later version
RUGGEDCOM RS900M-GETS-XX: Update to V4.3.8 or later version
RUGGEDCOM RS900M-STND-C01: Update to V4.3.8 or later version
RUGGEDCOM RS900M-STND-XX: Update to V4.3.8 or later version
RUGGEDCOM RS900MNC-GETS-C01: Update to V4.3.8 or later version
RUGGEDCOM RS900MNC-GETS-XX: Update to V4.3.8 or later version
RUGGEDCOM RS900MNC-STND-XX: Update to V4.3.8 or later version
RUGGEDCOM RS900MNC-STND-XX-C01: Update to V4.3.8 or later version
RUGGEDCOM RS900NC: Update to V4.3.8 or later version
RUGGEDCOM RS900NC with switch chip M88E6083: Currently no fix is planned.
RUGGEDCOM RS900NC(32M) V4.X: Update to V4.3.8 or later version
RUGGEDCOM RS900NC(32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900W: Update to V4.3.8 or later version
RUGGEDCOM RS910: Update to V4.3.8 or later version
RUGGEDCOM RS910L: Update to V4.3.8 or later version
RUGGEDCOM RS910LNC: Update to V4.3.8 or later version
RUGGEDCOM RS910NC: Update to V4.3.8 or later version
RUGGEDCOM RS910W: Update to V4.3.8 or later version
RUGGEDCOM RS920L: Update to V4.3.8 or later version
RUGGEDCOM RS920LNC: Update to V4.3.8 or later version
RUGGEDCOM RS920W: Update to V4.3.8 or later version
RUGGEDCOM RS930L: Update to V4.3.8 or later version
RUGGEDCOM RS930LNC: Update to V4.3.8 or later version
RUGGEDCOM RS930W: Update to V4.3.8 or later version
RUGGEDCOM RS940G: Update to V4.3.8 or later version
RUGGEDCOM RS940GF: Currently no fix is planned.
RUGGEDCOM RS940GNC: Update to V4.3.8 or later version
RUGGEDCOM RS969: Update to V4.3.8 or later version
RUGGEDCOM RS969NC: Update to V4.3.8 or later version
RUGGEDCOM RSG2100: Update to V4.3.8 or later version
RUGGEDCOM RSG2100 (32M) V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2100 (32M) V5.X: Currently no fix is available.
RUGGEDCOM RSG2100F: Currently no fix is planned.
RUGGEDCOM RSG2100NC: Update to V4.3.8 or later version
RUGGEDCOM RSG2100NC (32M) V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2100NC (32M) V5.X: Currently no fix is available.
RUGGEDCOM RSG2100P: Update to V4.3.8 or later version
RUGGEDCOM RSG2100PF: Currently no fix is planned.
RUGGEDCOM RSG2100PNC: Update to V4.3.8 or later version
RUGGEDCOM RSG2200: Update to V4.3.8 or later version
RUGGEDCOM RSG2200F: Currently no fix is planned.
RUGGEDCOM RSG2200NC: Update to V4.3.8 or later version
RUGGEDCOM RSG2288 V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2288 V5.X: Currently no fix is available.
RUGGEDCOM RSG2288NC V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2288NC V5.X: Currently no fix is available.
RUGGEDCOM RSG2300 V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2300 V5.X: Currently no fix is available.
RUGGEDCOM RSG2300F: Currently no fix is planned.
RUGGEDCOM RSG2300NC V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2300NC V5.X: Currently no fix is available.
RUGGEDCOM RSG2300P V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2300P V5.X: Currently no fix is available.
RUGGEDCOM RSG2300PF: Currently no fix is planned.
RUGGEDCOM RSG2300PNC V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2300PNC V5.X: Currently no fix is available.
RUGGEDCOM RSG2488 V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2488 V5.X: Currently no fix is available.
RUGGEDCOM RSG2488F: Currently no fix is planned.
RUGGEDCOM RSG2488NC V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG2488NC V5.X: Currently no fix is available.
RUGGEDCOM RSG907R: Currently no fix is available.
RUGGEDCOM RSG908C: Currently no fix is available.
RUGGEDCOM RSG909R: Currently no fix is available.
RUGGEDCOM RSG910C: Currently no fix is available.
RUGGEDCOM RSG920P V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG920P V5.X: Currently no fix is available.
RUGGEDCOM RSG920PNC V4.X: Update to V4.3.8 or later version
RUGGEDCOM RSG920PNC V5.X: Currently no fix is available.
RUGGEDCOM RSL910: Currently no fix is available.
RUGGEDCOM RSL910NC: Currently no fix is available.
RUGGEDCOM RST2228: Currently no fix is available.
RUGGEDCOM RST2228P: Currently no fix is available.
RUGGEDCOM RST916C: Currently no fix is available.
RUGGEDCOM RST916P: Currently no fix is available.

Siemens has identified the following specific workarounds and mitigations that customers can apply to reduce the risk:

Configure ingress filtering to control traffic flow when port mirroring is enabled:
Enable ingress filtering  
Disable RSTP on the target port(s)  
Disable neighbor discovery protocol on the target port(s)  
Disable LLDP on the target port(s) 

Further details can be found at  https://support.industry.siemens.com/cs/ww/en/view/109759351 

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-908185 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. 

1. EXECUTIVE SUMMARY

​CVSS v3 7.4
​ATTENTION: Exploitable remotely
​Vendor: Siemens
​Equipment: SIMATIC, SIPLUS
​Vulnerability: Improper Input Validation

2. RISK EVALUATION

​Successful exploitation of this vulnerability could allow an attacker to recover sensitive data or cause a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

​The following products from Siemens are affected: 

​SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0): versions prior to V2.9.7
​SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0): versions V3.0.1 to V3.0.3
​SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0): versions prior to V2.9.7
​SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0): versions V3.0.1 to V3.0.3
​SIMATIC ET 200SP Open Controller (incl. SIPLUS variants): all versions
​SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants): all versions
​SIMATIC IPC DiagBase: all versions
​SIMATIC IPC DiagMonitor: all versions
​SIMATIC S7-1200 CPU family (incl. SIPLUS variants): all versions
​SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ00-0AB0): all versions
​SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ00-0AB0): all versions
​SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DK03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK00-0AB0): all versions
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK00-0AB0): all versions
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK00-0AB0): all versions
​SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK00-0AB0): all versions
​SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DM03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL00-0AB0): all versions
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL00-0AB0): all versions
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RL00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RM03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1514SP-2 PN (6ES7514-2DN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM00-0AB0): all versions
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM00-0AB0): all versions
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RM00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN00-0AB0): all versions
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN00-0AB0): all versions
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1517H-3 PN (6ES7517-3HP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518F-4 PN/DP (6ES7518-4FP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0): versions prior to V3.0.3
​SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0): versions prior to V2.9.7
​SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0): versions prior to V2.9.7
​SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0): versions prior to V2.9.7
​SIMATIC S7-1500 Software Controller: all versions
​SIMATIC S7-PLCSIM Advanced: all versions
​SIPLUS ET 200SP CPU 1510SP F-1 PN (6AG1510-1SJ01-2AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL (6AG2510-1SJ01-1AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-2AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-7AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-4AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-1AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK00-2AB0): all versions
​SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-2AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-7AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-1AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-4AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-2AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-7AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-4AB0): versions prior to V2.9.7
​SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-1AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK00-2AB0): all versions
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0): versions prior to V2.9.7 
​SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK00-2AB0): all versions
​SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL00-2AB0): all versions 
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL00-2AB0): all versions
​SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1515R-2 PN (6AG1515-2RM00-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL (6AG2515-2RM00-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-2AB0): all versions
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN00-7AB0): all versions
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN00-2AB0): all versions
​SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0): versions prior to V2.9.7
​SIPLUS S7-1500 CPU 1517H-3 PN (6AG1517-3HP00-4AB0): versions prior to V3.0.3
​SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0): versions prior to V3.0.3
​SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0): versions prior to V3.0.3
​SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0): versions prior to V3.0.3
​SIPLUS S7-1500 CPU 1518HF-4 PN (6AG1518-4JP00-4AB0): versions prior to V3.0.3

3.2 VULNERABILITY OVERVIEW

3.2.1 ​IMPROPER INPUT VALIDATION CWE-20

​There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. This vulnerability may allow an attacker to pass arbitrary pointers to a memcmp call, enabling them to read memory contents or enact a denial of service.

​CVE-2023-0286 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H).

3.3 BACKGROUND

​CRITICAL INFRASTRUCTURE SECTORS: Multiple
​COUNTRIES/AREAS DEPLOYED: Worldwide
​COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

​Siemens reported this vulnerability to CISA.

4. MITIGATIONS

​Siemens has released updates for several affected products and recommends updating to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products where updates are not, or not yet available:

​SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0): Update to V2.9.7 or later
​SIMATIC Drive Controller CPU 1504D TF (6ES7615-4DF10-0AB0): Update to V3.0.3 or later
​SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0): Update to V2.9.7 or later
​SIMATIC Drive Controller CPU 1507D TF (6ES7615-7DF10-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SJ01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1510SP F-1 PN (6ES7510-1SK03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DJ01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1510SP-1 PN (6ES7510-1DK03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AK02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511-1 PN (6ES7511-1AL03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511C-1 PN (6ES7511-1CK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FK02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511F-1 PN (6ES7511-1FL03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511T-1 PN (6ES7511-1TL03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1511TF-1 PN (6ES7511-1UL03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1512C-1 PN (6ES7512-1CK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1512SP F-1 PN (6ES7512-1SM03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DK01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1512SP-1 PN (6ES7512-1DM03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AL02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1513-1 PN (6ES7513-1AM03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FL02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1513F-1 PN (6ES7513-1FM03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RL00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1513R-1 PN (6ES7513-1RM03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1514SP F-2 PN (6ES7514-2SN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1514SP-2 PN (6ES7514-2DN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1514SPT F-2 PN (6ES7514-2WN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1514SPT-2 PN (6ES7514-2VN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AM02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515-2 PN (6ES7515-2AN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FM02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515F-2 PN (6ES7515-2FN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RM00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515R-2 PN (6ES7515-2RN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TM01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515T-2 PN (6ES7515-2TN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UM01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1515TF-2 PN (6ES7515-2UN03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AN02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1516-3 PN/DP (6ES7516-3AP03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN01-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FN02-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU 1516F-3 PN/DP (6ES7516-3FP03-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1516T-3 PN/DP (6ES7516-3TN00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1516TF-3 PN/DP (6ES7516-3UN00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1517-3 PN/DP (6ES7517-3AP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1517F-3 PN/DP (6ES7517-3FP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1517H-3 PN (6ES7517-3HP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1517T-3 PN/DP (6ES7517-3TP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1517TF-3 PN/DP (6ES7517-3UP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518-4 PN/DP (6ES7518-4AP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518F-4 PN/DP (6ES7518-4FP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518HF-4 PN (6ES7518-4JP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518T-4 PN/DP (6ES7518-4TP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU 1518TF-4 PN/DP (6ES7518-4UP00-0AB0): Update to V3.0.3 or later
​SIMATIC S7-1500 CPU S7-1518-4 PN/DP ODK (6ES7518-4AP00-3AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 CPU S7-1518F-4 PN/DP ODK (6ES7518-4FP00-3AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 ET 200pro: CPU 1513PRO F-2 PN (6ES7513-2GL00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 ET 200pro: CPU 1513PRO-2 PN (6ES7513-2PL00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 ET 200pro: CPU 1516PRO F-2 PN (6ES7516-2GN00-0AB0): Update to V2.9.7 or later
​SIMATIC S7-1500 ET 200pro: CPU 1516PRO-2 PN (6ES7516-2PN00-0AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1510SP F-1 PN (6AG1510-1SJ01-2AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1510SP F-1 PN RAIL (6AG2510-1SJ01-1AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-2AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1510SP-1 PN (6AG1510-1DJ01-7AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-4AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1510SP-1 PN RAIL (6AG2510-1DJ01-1AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-2AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP F-1 PN (6AG1512-1SK01-7AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-1AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP F-1 PN RAIL (6AG2512-1SK01-4AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-2AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP-1 PN (6AG1512-1DK01-7AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-4AB0): Update to V2.9.7 or later
​SIPLUS ET 200SP CPU 1512SP-1 PN RAIL (6AG2512-1DK01-1AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK01-7AB0): Update to V2.9.7 or later 
​SIPLUS S7-1500 CPU 1511-1 PN (6AG1511-1AK02-7AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK01-1AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN T1 RAIL (6AG2511-1AK02-1AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK01-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511-1 PN TX RAIL (6AG2511-1AK02-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1511F-1 PN (6AG1511-1FK02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-7AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1513-1 PN (6AG1513-1AL02-7AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1513F-1 PN (6AG1513-1FL02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1515F-2 PN (6AG1515-2FM02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1515F-2 PN RAIL (6AG2515-2FM02-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1515F-2 PN T2 RAIL (6AG2515-2FM01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1515R-2 PN (6AG1515-2RM00-7AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1515R-2 PN TX RAIL (6AG2515-2RM00-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-7AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516-3 PN/DP (6AG1516-3AN02-7AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516-3 PN/DP RAIL (6AG2516-3AN02-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516-3 PN/DP TX RAIL (6AG2516-3AN01-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516F-3 PN/DP (6AG1516-3FN01-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-2AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1516F-3 PN/DP RAIL (6AG2516-3FN02-4AB0): Update to V2.9.7 or later
​SIPLUS S7-1500 CPU 1517H-3 PN (6AG1517-3HP00-4AB0): Update to V3.0.3 or later
​SIPLUS S7-1500 CPU 1518-4 PN/DP (6AG1518-4AP00-4AB0): Update to V3.0.3 or later
​SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0): Update to V3.0.3 or later
​SIPLUS S7-1500 CPU 1518F-4 PN/DP (6AG1518-4FP00-4AB0): Update to V3.0.3 or later
​SIPLUS S7-1500 CPU 1518HF-4 PN (6AG1518-4JP00-4AB0): Update to V3.0.3 or later

​Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

​Disable CRL (certification revocation list) checking, if possible

​As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals. Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

​For further inquiries on security vulnerabilities in Siemens products and solutions, please contact the Siemens ProductCERT 

​For more information see the associated Siemens security advisory SSA-264815 in HTML and CSAF.

​CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

​Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
​Locate control system networks and remote devices behind firewalls and isolate them from business networks.
​When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

​CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

​CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

​Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

​Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

​No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.