ICSA-18-317-08

Siemens SIMATIC Panels

view advisory published 2018-11-13

As a general security measure, Siemens strongly recommends to protect network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends to configure the environment according to Siemens' operational guidelines for Industrial Security (Download: https://www.siemens.com/cert/operational-guidelines-industrial-security), and to follow the recommendations in the product manuals.

describes (2)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-13813US	high8.1	1.68% (77th)	—	2018-12-13
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4),…
CVE-2018-13812US	high7.5	3.57% (89th)	—	2018-12-13
A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15 Update 4), SIMATIC HMI Comfort Outdoor Panels 7" & 15" (All versions < V15 Update 4),…

references

External citations — patches, advisories, analysis.

SSA-233109: Web Vulnerabilities in SIMATIC Panels - HTML Versionself
ICS Advisory ICSA-18-317-08 JSONself
Recommended Practicesexternal
ICS Advisory ICSA-18-317-08 - Web Versionself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal

remediations (26)

MitigationSIMATIC HMI Classic Devices - TP/MP/OP/MP Mobile Panel (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI Classic Devices - TP/MP/OP/MP Mobile Panel (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI KTP Mobile Panels KTP400F
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC HMI KTP Mobile Panels KTP400F
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC WinCC (TIA Portal)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC WinCC (TIA Portal)
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC WinCC Runtime Advanced
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC WinCC Runtime Advanced
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC WinCC Runtime Professional
Deactivate the web server if not required. The web server is disabled by default.
MitigationSIMATIC WinCC Runtime Professional
Deactivate the web server if not required. The web server is disabled by default.
FixedSIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC HMI KTP Mobile Panels KTP400F
Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC HMI KTP Mobile Panels KTP400F
Update SIMATIC WinCC (TIA Portal) to V15 Update 4 or newer, and then update panel to V15 Update 4 or newer. https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC WinCC (TIA Portal)
Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC WinCC (TIA Portal)
Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC WinCC Runtime Advanced
Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC WinCC Runtime Advanced
Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC WinCC Runtime Professional
Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826
FixedSIMATIC WinCC Runtime Professional
Update to V15 Update 4 or newer https://support.industry.siemens.com/cs/ww/en/view/109755826

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan