Siemens OpenSSL Vulnerability in Industrial Products (Update E)
Several Siemens industrial products are affected by a vulnerability in OpenSSL, that could result in data being sent out unencrypted by the SSL/TLS record layer. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2017-3737US | medium5.9OT high | — | ||
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenSSL would move into th… | ||||
references
External citations — patches, advisories, analysis.
- SSA-179516 OpenSSL Vulnerability in Industrial Products - CSAF Versionself
- SSA-179516 OpenSSL Vulnerability in Industrial Products - PDF Versionself
- SSA-179516 OpenSSL Vulnerability in Industrial Products - TXT Versionself
- ICS Advisory ICSA-18-226-02 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-18-226-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (40)
- MitigationMindConnect IoT2040
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationMindConnect Nano (IPC227D)
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC HMI WinCC Flexible
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC IPC DiagBase
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC IPC DiagMonitor
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Disable web server within the device configuration if it is not used or limit access to the web server on a particular Ethernet/PROFINET port/interface if possible (setting is under General / Web server access).
- MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC S7-1500 Software Controller
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC STEP 7 (TIA Portal) V13
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC STEP 7 (TIA Portal) V14
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC STEP 7 (TIA Portal) V15
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC WinCC (TIA Portal) V13
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC WinCC (TIA Portal) V14
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC WinCC (TIA Portal) V15
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC WinCC OA V3.14
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC WinCC OA V3.15
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSIMATIC WinCC OA V3.16
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSINUMERIK Integrate Access MyMachine service engineer client as part of Sinumerik Integrate Product suite
Limit network access using appropriate mechanisms (e.g., firewalls)
- MitigationSINUMERIK Integrate Operate Client as part of Sinumerik Integrate Product suite
Limit network access using appropriate mechanisms (e.g., firewalls)
- FixedMindConnect IoT2040
Update to V03.01 or later version. Use the Mindsphere web frontend to update
- FixedMindConnect Nano (IPC227D)
Update to V03.01 or later version. Use the Mindsphere web frontend to update
- FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)
Update to V2.1.6 or later version
https://support.industry.siemens.com/cs/us/en/view/109759122 - FixedSIMATIC HMI WinCC Flexible
Update to V15.1 or later version
https://support.industry.siemens.com/cs/us/en/view/109758794 - FixedSIMATIC IPC DiagBase
Update to V2.1.1.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109792891 - FixedSIMATIC IPC DiagMonitor
Update to V5.0.3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109740915 - FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to V4.2.3 or later version
https://support.industry.siemens.com/cs/us/en/view/109741461 - FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
Update to V2.5.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459 - FixedSIMATIC S7-1500 Software Controller
Update to V2.6 or later version
https://support.industry.siemens.com/cs/us/en/view/109478528 - FixedSIMATIC STEP 7 (TIA Portal) V13
Update to V13 SP2 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759753 - FixedSIMATIC STEP 7 (TIA Portal) V14
Update to V14 SP1 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747387 - FixedSIMATIC STEP 7 (TIA Portal) V15
Update to V15 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109755826 - FixedSIMATIC WinCC (TIA Portal) V13
Update to V13 SP2 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759753 - FixedSIMATIC WinCC (TIA Portal) V14
Update to V14 SP1 Upd 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109747387 - FixedSIMATIC WinCC (TIA Portal) V15
Update to V15 Update 2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109755826 - FixedSIMATIC WinCC OA V3.14
Update to V3.14 P021 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSIMATIC WinCC OA V3.15
Update to V3.15 P014 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSIMATIC WinCC OA V3.16
Update to V3.16 P002 or later version
https://www.winccoa.com/downloads/category/versions-patches.html - FixedSINUMERIK Integrate Access MyMachine service engineer client as part of Sinumerik Integrate Product suite
Update to V4.1.8, installing latest Sinumerik Integrate Product suite.
https://w3.siemens.com/aspa_app - FixedSINUMERIK Integrate Operate Client as part of Sinumerik Integrate Product suite
Update to V2.0.12 / 3.0.12, installing latest Sinumerik Integrate Product suite.
https://w3.siemens.com/aspa_app
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan