Siemens TIA Portal
The know-how protection feature in Totally Integrated Automation Portal (TIA Portal) does not properly update the encryption of existing program blocks when a project file is updated. This could allow attackers with access to the project file to recover previous - yet unprotected - versions of the project without the knowledge of the know-how protection password. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2023-30757US | medium5.5 | — | ||
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), T… | ||||
references
External citations — patches, advisories, analysis.
- SSA-042050: Know-How Protection Mechanism Failure in TIA Portal - CSAF Versionself
- SSA-042050: Know-How Protection Mechanism Failure in TIA Portal - HTML Versionself
- ICS Advisory ICSA-23-166-06 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-166-06 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (16)
- MitigationTotally Integrated Automation Portal (TIA Portal) V14
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109742284?c=87347935883)
- MitigationTotally Integrated Automation Portal (TIA Portal) V15
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109764516?c=105012867723)
- MitigationTotally Integrated Automation Portal (TIA Portal) V15.1
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109755202?c=105012867723)
- MitigationTotally Integrated Automation Portal (TIA Portal) V16
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109773506?c=126979557387)
- MitigationTotally Integrated Automation Portal (TIA Portal) V17
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109798671?c=132780438283)
- MitigationTotally Integrated Automation Portal (TIA Portal) V18
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109815056?c=132780438283)
- MitigationTotally Integrated Automation Portal (TIA Portal) V19
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapters "Security information" and "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/ww/en/view/109826862/)
- MitigationTotally Integrated Automation Portal (TIA Portal) V20
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://docs.tia.siemens.cloud/r/en-us/v20/protecting-blocks)
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V17
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V18
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V19
Currently no fix is planned
- No fix plannedTotally Integrated Automation Portal (TIA Portal) V20
Currently no fix is planned
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan