ICSA-23-285-01

icsaUScisa_csaf_ot

Siemens SIMATIC CP products

view advisory published 2023-10-10

Several SIMATIC CP devices contain direct memory access vulnerabilities that could allow an attacker to execute code, access the PROFINET network without restrictions or perform denial of service attacks. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

01

describes (2)

Related CVEs.

IDseverity exploitable
CVE-2023-37195US——
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 16…
CVE-2023-37194US——
A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMATIC CP 1626 (All versions), SIMATIC CP 16…
02

references

External citations — patches, advisories, analysis.

03

remediations (20)

  • MitigationSIMATIC CP 1604 (6GK1160-4AA01)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1604 (6GK1160-4AA01)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1616 (6GK1161-6AA02)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1616 (6GK1161-6AA02)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1623 (6GK1162-3AA00)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1623 (6GK1162-3AA00)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1626 (6GK1162-6AA01)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1626 (6GK1162-6AA01)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1628 (6GK1162-8AA00)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • MitigationSIMATIC CP 1628 (6GK1162-8AA00)

    Ensure that only trusted persons have access to the system and avoid the configuration of additional accounts with admin rights.

  • No fix plannedSIMATIC CP 1604 (6GK1160-4AA01)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1604 (6GK1160-4AA01)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1616 (6GK1161-6AA02)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1616 (6GK1161-6AA02)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1623 (6GK1162-3AA00)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1623 (6GK1162-3AA00)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1626 (6GK1162-6AA01)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1626 (6GK1162-6AA01)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1628 (6GK1162-8AA00)

    Currently no fix is planned

  • No fix plannedSIMATIC CP 1628 (6GK1162-8AA00)

    Currently no fix is planned

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan