SSA-865327: Incorrect Authorization Vulnerability in Industrial Products
The latest updates for the below mentioned products fix a vulnerability that allows an unauthenticated attacker to read PLC variables from affected devices without proper authentication under certain circumstances. Siemens has released updates for some of the affected products, is working on updates for the remaining affected products and recommends specific countermeasures until fixes are available.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-28397US | medium5.3OT elevated | — | ||
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All version… | ||||
references
External citations — patches, advisories, analysis.
remediations (7)
- FixedSIMATIC Drive Controller family
Update to V2.9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773914/ - FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
Update to V21.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759122/ - FixedSIMATIC S7 PLCSIM Advanced
Updated to V4 or later version
https://support.industry.siemens.com/cs/de/en/view/109795016 - FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to V4.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793280 - FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
Update to V2.9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - FixedSIMATIC S7-1500 Software Controller
Update to V21.9 or later version
https://support.industry.siemens.com/cs/de/en/view/109478528/ - FixedTIM 1531 IRC (incl. SIPLUS NET variants)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109798331
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan