ICSA-24-256-09

Siemens SIMATIC, SIPLUS, and TIM

view advisory published 2024-09-10

Multiple NULL pointer dereference vulnerabilities in the affected products could allow an attacker with network access to the webserver, to perform a denial of service attack. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.

describes (3)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-30756US	—	0.45% (38th)	—	2024-09-10
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SI…
CVE-2023-30755US	—	0.43% (37th)	—	2024-09-10
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SI…
CVE-2023-28827US	—	0.45% (38th)	—	2024-09-10
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.5.20), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.5.20), SI…

references

External citations — patches, advisories, analysis.

remediations (72)

No fix plannedSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Currently no fix is planned
No fix plannedSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Currently no fix is planned
No fix plannedSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Currently no fix is planned
No fix plannedSIMATIC IPC DiagBase
Currently no fix is planned
No fix plannedSIMATIC IPC DiagBase
Currently no fix is planned
No fix plannedSIMATIC IPC DiagBase
Currently no fix is planned
No fix plannedSIMATIC IPC DiagMonitor
Currently no fix is planned
No fix plannedSIMATIC IPC DiagMonitor
Currently no fix is planned
No fix plannedSIMATIC IPC DiagMonitor
Currently no fix is planned
No fix plannedSIMATIC WinCC Runtime Advanced
Currently no fix is planned
No fix plannedSIMATIC WinCC Runtime Advanced
Currently no fix is planned
No fix plannedSIMATIC WinCC Runtime Advanced
Currently no fix is planned
FixedSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-7 LTE
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-7 LTE
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-7 LTE
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Update to V3.5.20 or later version
https://support.industry.siemens.com/cs/ww/en/view/109972735/
FixedSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
Update to V2.4.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954889/
FixedSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
Update to V2.4.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954889/
FixedSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
Update to V2.4.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954889/
FixedTIM 1531 IRC (6GK7543-1MX00-0XE0)
Update to V2.4.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954889/
FixedTIM 1531 IRC (6GK7543-1MX00-0XE0)
Update to V2.4.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954889/
FixedTIM 1531 IRC (6GK7543-1MX00-0XE0)
Update to V2.4.8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109954889/
WorkaroundSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-7 LTE
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-7 LTE
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-7 LTE
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Disable the web server of the affected system
WorkaroundSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Disable the web server of the affected system
WorkaroundSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Disable the web server of the affected system
WorkaroundSIMATIC IPC DiagBase
Disable the web server of the affected system
WorkaroundSIMATIC IPC DiagBase
Disable the web server of the affected system
WorkaroundSIMATIC IPC DiagBase
Disable the web server of the affected system
WorkaroundSIMATIC IPC DiagMonitor
Disable the web server of the affected system
WorkaroundSIMATIC IPC DiagMonitor
Disable the web server of the affected system
WorkaroundSIMATIC IPC DiagMonitor
Disable the web server of the affected system
WorkaroundSIMATIC WinCC Runtime Advanced
Disable the web server of the affected system
WorkaroundSIMATIC WinCC Runtime Advanced
Disable the web server of the affected system
WorkaroundSIMATIC WinCC Runtime Advanced
Disable the web server of the affected system
WorkaroundSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
Disable the web server of the affected system
WorkaroundSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
Disable the web server of the affected system
WorkaroundSIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0)
Disable the web server of the affected system
WorkaroundTIM 1531 IRC (6GK7543-1MX00-0XE0)
Disable the web server of the affected system
WorkaroundTIM 1531 IRC (6GK7543-1MX00-0XE0)
Disable the web server of the affected system
WorkaroundTIM 1531 IRC (6GK7543-1MX00-0XE0)
Disable the web server of the affected system

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan