ICSA-22-132-12

icsaUScisa_csaf_ot

Siemens Industrial Products

view advisory published 2022-05-10

A vulnerability has been identified in the OPC Foundation Local Discovery Server (LDS) [0] of several industrial products. The vulnerability could cause a denial of service condition on the service or the device. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available. [0] https://files.opcfoundation.org/SecurityBulletins/OPC%20Foundation%20Security%20Bulletin%20CVE-2021-40142.pdf

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2021-40142UShigh7.5—
In OPC Foundation Local Discovery Server (LDS) before 1.04.402.463, remote attackers can cause a denial of service (DoS) by sending carefully crafted messages that lead to Access o…
02

references

External citations — patches, advisories, analysis.

03

remediations (20)

  • MitigationOpenPCS 7 V9.1

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC NET PC Software V14

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC NET PC Software V15

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC NET PC Software V16

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC NET PC Software V17

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC Process Historian OPC UA Server

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC WinCC

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC WinCC Runtime Professional

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationSIMATIC WinCC Unified PC Runtime V18

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • MitigationTeleControl Server Basic V3

    Deactivate the OPC LDS Service if supported by the product use case. The LDS service is not activated in the default configuration

  • No fix plannedOpenPCS 7 V9.1

    Currently no fix is planned

  • No fix plannedSIMATIC NET PC Software V15

    Currently no fix is planned

  • FixedSIMATIC NET PC Software V14

    Update to V14 SP1 Update 14 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109807351/
  • FixedSIMATIC NET PC Software V16

    Update to V16 Update 6 or later version

  • FixedSIMATIC NET PC Software V17

    Update to V17 SP1 or later version

  • FixedSIMATIC Process Historian OPC UA Server

    For PCS 7: Update to PCS 7 V9.1 SP1 ( https://support.industry.siemens.com/cs/ww/en/view/109805073/)

  • FixedSIMATIC WinCC

    Update to V8.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109816599/
  • FixedSIMATIC WinCC Runtime Professional

    Update to V18 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109813587/
  • FixedSIMATIC WinCC Unified PC Runtime V18

    Update to V18 Update 1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109807123/
  • FixedTeleControl Server Basic V3

    Update to V3.1.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109812231/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan