Siemens SIMATIC Process Historian
The latest update for SIMATIC Process Historian (PH) fixes an authentication vulnerability in the configuration interface of redundant PH instances that could enable the execution of admin operations on the database. The related vulnerable interface is restricted to local access on recent versions starting from SIMATIC Process Historian 2020. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-27395US | high8.1OT elevated | — | ||
A vulnerability has been identified in SIMATIC Process Historian 2013 and earlier (All versions), SIMATIC Process Historian 2014 (All versions < SP3 Update 6), SIMATIC Process Hist… | ||||
references
External citations — patches, advisories, analysis.
- SSA-766247: Authentication Vulnerability in SIMATIC Process Historian - CSAF Versionself
- SSA-766247: Authentication Vulnerability in SIMATIC Process Historian - PDF Versionself
- SSA-766247: Authentication Vulnerability in SIMATIC Process Historian - TXT Versionself
- ICS Advisory ICSA-21-287-09 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-287-09 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (8)
- MitigationSIMATIC Process Historian 2013 and earlier
Consider upgrading to a newer SIMATIC Process Historian version
- MitigationSIMATIC Process Historian 2014
Deactivate following incoming rules in the local Windows firewall: - PH Redundancy Services - PH Wcf MessageQueue Service (RedundancyMaintenanceService) - PH Wcf MessageQueue Service (SqlMirroringSetup) - PH Wcf MessageQueue Service (MaintenanceService) - PH SQL-Server Mirroring Port (UDP) - PH SQL-Server Mirroring Port (TCP)
- MitigationSIMATIC Process Historian 2019
Consider upgrading to a newer SIMATIC Process Historian version
- MitigationSIMATIC Process Historian 2020
Deactivate following incoming rules in the local Windows firewall: - PH Redundancy Services - PH Wcf MessageQueue Service (RedundancyMaintenanceService) - PH Wcf MessageQueue Service (SqlMirroringSetup) - PH Wcf MessageQueue Service (MaintenanceService) - PH SQL-Server Mirroring Port (UDP) - PH SQL-Server Mirroring Port (TCP)
- No fix plannedSIMATIC Process Historian 2013 and earlier
Currently no remediation is planned
- No fix plannedSIMATIC Process Historian 2019
Currently no remediation is planned
- FixedSIMATIC Process Historian 2014
Update to SP3 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780528/ - FixedSIMATIC Process Historian 2020
To update, use the Process Historian version as bundled with PCS neo V3.1 Upd1 (https://support.industry.siemens.com/cs/ww/en/view/109804750/) or with PCS 7 V9.1 SP1 (https://support.industry.siemens.com/cs/ww/en/view/109805073/)
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan