ICSA-23-348-06

Siemens OPC UA Implementation in SINUMERIK ONE and SINUMERIK MC

view advisory published 2023-12-12

SINUMERIK ONE and SINUMERIK MC products are affected by a denial of service vulnerability in the OPC UA implementation of the integrated S7-1500 CPU. The vulnerability in the integrated S7-1500 CPU is documented in more detail in SSA-711309 [1]. Siemens has released updates for the affected products and recommends to update to the latest versions. [1] https://cert-portal.siemens.com/productcert/html/ssa-711309.html

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-28831US	high7.5	1.13% (66th)	—	2023-09-12
The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application to run into an infinite loop during cert…

references

External citations — patches, advisories, analysis.

remediations (4)

MitigationSINUMERIK MC
Expose the OPC UA interface of the integrated S7-1500 CPU only to trusted network environments
MitigationSINUMERIK ONE
Expose the OPC UA interface of the integrated S7-1500 CPU only to trusted network environments
FixedSINUMERIK MC
Update to V1.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109824227/
FixedSINUMERIK ONE
Update to V6.22 or later version
https://support.industry.siemens.com/cs/ww/en/view/109824227/

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan