Siemens SIMATIC STEP 7 (TIA Portal)
An attacker could achieve privilege escalation on the web server of certain devices configured by SIMATIC STEP 7 (TIA Portal) due to incorrect handling of the webserver's user management configuration during downloading. This only affects the S7-1200 and S7-1500 CPUs' (incl. related ET200 CPUs and SIPLUS variants) web server, when activated. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-42029US | high7.8 | — | ||
A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) V15 (All versions), SIMATIC STEP 7 (TIA Portal) V16 (All versions < V16 Update 5), SIMATIC STEP 7 (TIA Portal) V1… | ||||
references
External citations — patches, advisories, analysis.
- SSA-350757: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Related ET200 CPUs and SIPLUS variants) - CSAF Versionself
- SSA-350757: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Related ET200 CPUs and SIPLUS variants) - PDF Versionself
- SSA-350757: Improper Access Control Vulnerability in TIA Portal Affecting S7-1200 and S7-1500 CPUs Web Server (Incl. Related ET200 CPUs and SIPLUS variants) - TXT Versionself
- ICS Advisory ICSA-22-104-14 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-104-14 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (6)
- MitigationSIMATIC STEP 7 (TIA Portal) V15
In case a new TIA-Portal version is not available, updating the web server's user configuration is not effective in this situation. Instead - the PLC must be deleted and reconfigured with a new project. WARNING: The PLC-program should be copied before deleting the PLC. Or - the original project (one that was not uploaded by a PLC) should be used to update the web server's user management and to download the changed configuration
- MitigationSIMATIC STEP 7 (TIA Portal) V16
In case a new TIA-Portal version is not available, updating the web server's user configuration is not effective in this situation. Instead - the PLC must be deleted and reconfigured with a new project. WARNING: The PLC-program should be copied before deleting the PLC. Or - the original project (one that was not uploaded by a PLC) should be used to update the web server's user management and to download the changed configuration
- MitigationSIMATIC STEP 7 (TIA Portal) V17
In case a new TIA-Portal version is not available, updating the web server's user configuration is not effective in this situation. Instead - the PLC must be deleted and reconfigured with a new project. WARNING: The PLC-program should be copied before deleting the PLC. Or - the original project (one that was not uploaded by a PLC) should be used to update the web server's user management and to download the changed configuration
- No fix plannedSIMATIC STEP 7 (TIA Portal) V15
Currently no fix is planned
- FixedSIMATIC STEP 7 (TIA Portal) V16
Update to V16 Update 5 or later version
https://support.industry.siemens.com/cs/gb/en/view/109775861/ - FixedSIMATIC STEP 7 (TIA Portal) V17
Update to V17 Update 2 or later version
https://support.industry.siemens.com/cs/gb/en/view/109784441/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan