SSA-232418

csafDEsiemens_psirt

SSA-232418: Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU Families

view advisory published 2019-08-13

Two vulnerabilities have been identified in the SIMATIC S7-1200/S7-1500 CPU families and related products. One vulnerability (CVE-2019-10943) could allow an attacker with network access to affected devices to modify the user program stored on these devices such that the source code differs from the actual running code. The other vulnerability (CVE-2019-10929) could allow an attacker in a Man- in-the-Middle position to modify network traffic exchanged on port 102/tcp. Siemens has released updates for several affected products to fix CVE-2019-10929 and recommends to update to the latest versions. Regarding CVE-2019-10943, Siemens recommends specific countermeasures for products where updates are not, or not yet available.

01

describes (2)

Related CVEs.

IDseverity exploitable
CVE-2019-10943UShigh7.5OT elevated—
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATI…
CVE-2019-10929USmedium5.9OT elevated—
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open…
02

references

External citations — patches, advisories, analysis.

03

remediations (31)

  • MitigationSIMATIC Drive Controller family

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 Software Controller

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 Software Controller

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-PLCSIM Advanced

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-PLCSIM Advanced

    Apply password protection for S7 communication

  • No fix plannedSIMATIC Drive Controller family

    Currently no fix is planned

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Currently no fix is planned

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Currently no fix is planned

  • No fix plannedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Currently no fix is planned

  • No fix plannedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Currently no fix is planned

  • No fix plannedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Currently no fix is planned

  • No fix plannedSIMATIC S7-1500 Software Controller

    Currently no fix is planned

  • No fix plannedSIMATIC S7-PLCSIM Advanced

    Currently no fix is planned

  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Update to V4.4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Update to V4.4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Update to V2.8.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Update to V2.8.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • FixedSIMATIC S7-1500 Software Controller

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772864/
  • FixedSIMATIC S7-1500 Software Controller

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772864/
  • FixedSIMATIC S7-PLCSIM Advanced

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772889/
  • FixedSIMATIC S7-PLCSIM Advanced

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772889/
scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan