ICSA-15-335-03

Siemens SIMATIC Communication Processor Vulnerability (Update C)

view advisory published 2015-11-27

SIMATIC CP and TIM devices contain an authentication bypass vulnerability that could allow unauthenticated users to perform administrative operations under certain conditions. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2015-8214US	high9.7OT elevated	2.09% (82nd)	—	2015-11-27
A vulnerability has been identified in SIMATIC NET CP 342-5 (incl. SIPLUS variants) (All versions), SIMATIC NET CP 343-1 Advanced (incl. SIPLUS variants) (All versions < V3.0.44),…

references

External citations — patches, advisories, analysis.

remediations (28)

No fix plannedSIMATIC CP 342-5 (6GK7342-5DA02-0XE0)
Currently no fix is planned
No fix plannedSIMATIC CP 342-5 (6GK7342-5DA03-0XE0)
Currently no fix is planned
No fix plannedSIMATIC CP 342-5 FO (6GK7342-5DF00-0XE0)
Currently no fix is planned
No fix plannedSIMATIC CP 443-5 Basic (6GK7443-5FX02-0XE0)
Currently no fix is planned
No fix plannedSIMATIC CP 443-5 Extended (6GK7443-5DX05-0XE0)
Currently no fix is planned
No fix plannedSIMATIC CP 443-5 Extended (6GK7443-5DX05-0XE1)
Currently no fix is planned
No fix plannedSIPLUS NET CP 443-5 (6AG1443-5DX05-4XE0)
Currently no fix is planned
No fix plannedSIPLUS NET CP342-5 (6AG1342-5DA03-7XE0)
Currently no fix is planned
FixedSIMATIC CP 343-1 (6GK7343-1EX30-0XE0)
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109486101/
FixedSIMATIC CP 343-1 Advanced (6GK7343-1GX31-0XE0)
Update to V3.0.44 or later version
https://support.industry.siemens.com/cs/ww/en/view/109742236/
FixedSIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0)
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109486101/
FixedSIMATIC CP 443-1 (6GK7443-1EX30-0XE0)
Update to V3.2.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109482246/
FixedSIMATIC CP 443-1 (6GK7443-1EX30-0XE1)
Update to V3.2.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109482246/
FixedSIMATIC CP 443-1 Advanced (6GK7443-1GX30-0XE0)
Update to V3.2.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109482246/
FixedSIPLUS NET CP 343-1 (6AG1343-1EX30-7XE0)
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109486101/
FixedSIPLUS NET CP 343-1 Advanced (6AG1343-1GX31-4XE0)
Update to V3.0.44 or later version
https://support.industry.siemens.com/cs/ww/en/view/109742236/
FixedSIPLUS NET CP 343-1 Lean (6AG1343-1CX10-2XE0)
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109486101/
FixedSIPLUS NET CP 443-1 (6AG1443-1EX30-4XE0)
Update to V3.2.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109482246/
FixedSIPLUS NET CP 443-1 Advanced (6AG1443-1GX30-4XE0)
Update to V3.2.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109482246/
FixedSIPLUS NET TIM 3V-IE (6AG1800-3BA00-7AA0)
Update to V2.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481769/
FixedSIPLUS NET TIM 3V-IE DNP3 (6AG1803-3BA00-7AA0)
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481766/
FixedSIPLUS NET TIM 4R-IE (6AG1800-4BA00-7AA0)
Update to V2.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481769/
FixedSIPLUS NET TIM 4R-IE DNP3 (6AG1803-4BA00-7AA0)
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481765/
FixedTIM 3V-IE (6NH7800-3BA00)
Update to V2.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481769/
FixedTIM 3V-IE Advanced (6NH7800-3CA00)
Update to V2.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481769/
FixedTIM 3V-IE DNP3 (6NH7803-3BA00-0AA0)
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481766/
FixedTIM 4R-IE (6NH7800-4BA00)
Update to V2.6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481769/
FixedTIM 4R-IE DNP3 (6NH7803-4BA00-0AA0)
Update to V3.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109481765/

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan