SSA-270778: Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC Software
A Denial-of-Service vulnerability was found in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC software when encrypted communication is enabled. The vulnerability could allow an attacker with network access to cause a Denial-of-Service condition under certain circumstances (versions prior to SIMATIC WinCC V7.3 or SIMATIC PCS 7 V8.1 are not affected as encrypted communication is not an option). Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available. Note: The vulnerability is part of a shared component, used by various Siemens products (SIMATIC Communication Services - SCS). The installation of a fix version of any product also removes the vulnerability for other products on the same system, even if those products were not updated.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-19282US | high7.1 | — | ||
A vulnerability has been identified in OpenPCS 7 V8.1 (All versions), OpenPCS 7 V8.2 (All versions), OpenPCS 7 V9.0 (All versions < V9.0 Upd3), SIMATIC BATCH V8.1 (All versions), S… | ||||
references
External citations — patches, advisories, analysis.
- SSA-270778: Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC Software - CSAF Versionself
- SSA-270778: Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC Software - HTML Versionself
- SSA-270778: Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC Software - PDF Versionself
- SSA-270778: Denial-of-Service Vulnerability in SIMATIC PCS 7, SIMATIC WinCC and SIMATIC NET PC Software - TXT Versionself
remediations (44)
- MitigationOpenPCS 7 V8.1
Use VPN for protecting network communication between cells
- MitigationOpenPCS 7 V8.2
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 14 or later version is installed on the same system
- MitigationOpenPCS 7 V9.0
Use VPN for protecting network communication between cells
- MitigationSIMATIC BATCH V8.1
Use VPN for protecting network communication between cells
- MitigationSIMATIC BATCH V8.2
Use VPN for protecting network communication between cells
- MitigationSIMATIC BATCH V9.0
Use VPN for protecting network communication between cells
- MitigationSIMATIC NET PC Software V14
Use VPN for protecting network communication between cells
- MitigationSIMATIC NET PC Software V15
Use VPN for protecting network communication between cells
- MitigationSIMATIC NET PC Software V16
Use VPN for protecting network communication between cells
- MitigationSIMATIC PCS 7 V8.1
Use VPN for protecting network communication between cells
- MitigationSIMATIC PCS 7 V8.2
Use VPN for protecting network communication between cells
- MitigationSIMATIC PCS 7 V9.0
Use VPN for protecting network communication between cells
- MitigationSIMATIC Route Control V8.1
Use VPN for protecting network communication between cells
- MitigationSIMATIC Route Control V8.2
The vulnerability is fixed if SIMATIC WinCC V7.4 SP1 Update 14 or later version is installed on the same system
- MitigationSIMATIC Route Control V9.0
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC (TIA Portal) V13
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC (TIA Portal) V14
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC (TIA Portal) V15.1
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC (TIA Portal) V16
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC V7.3
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC V7.4
Use VPN for protecting network communication between cells
- MitigationSIMATIC WinCC V7.5
Use VPN for protecting network communication between cells
- No fix plannedOpenPCS 7 V8.1
Currently no fix is planned
- No fix plannedOpenPCS 7 V8.2
Currently no fix is planned
- No fix plannedSIMATIC BATCH V8.1
Currently no fix is planned
- No fix plannedSIMATIC NET PC Software V15
Currently no fix is planned
- No fix plannedSIMATIC PCS 7 V8.1
Currently no fix is planned
- No fix plannedSIMATIC Route Control V8.1
Currently no fix is planned
- No fix plannedSIMATIC Route Control V8.2
Currently no fix is planned
- No fix plannedSIMATIC WinCC V7.3
Currently no fix is planned
- FixedOpenPCS 7 V9.0
See remediation for SIMATIC PCS 7 V9.0
- FixedSIMATIC BATCH V8.2
Update to V8.2 Upd12 or later version
https://support.industry.siemens.com/cs/ww/en/view/109757796/ - FixedSIMATIC BATCH V9.0
See remediation for SIMATIC PCS 7 V9.0
- FixedSIMATIC NET PC Software V14
Update to V14 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807351/ - FixedSIMATIC NET PC Software V16
Update to V16 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109778547/ - FixedSIMATIC PCS 7 V8.2
Update to V8.2 SP1; then update SIMATIC WinCC to V7.4 SP1 Update 14 or later version on the same system
https://support.industry.siemens.com/cs/ww/en/view/109758443/ - FixedSIMATIC PCS 7 V9.0
Update to V9.0 SP3 or later version
https://support.industry.siemens.com/cs/ww/en/view/109780584/ - FixedSIMATIC Route Control V9.0
See remediation for SIMATIC PCS 7 V9.0
- FixedSIMATIC WinCC (TIA Portal) V13
Update to V13 SP2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759782/ - FixedSIMATIC WinCC (TIA Portal) V14
Update to V14 SP1 Update 10 or later version
https://support.industry.siemens.com/cs/us/en/view/109747387/ - FixedSIMATIC WinCC (TIA Portal) V15.1
Update to V15.1 Update 5 or later version
https://support.industry.siemens.com/cs/us/en/view/109763890/ - FixedSIMATIC WinCC (TIA Portal) V16
Update to V16 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109775861/ - FixedSIMATIC WinCC V7.4
Update to V7.4 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/us/en/view/109779373/ - FixedSIMATIC WinCC V7.5
Update to V7.5 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773812/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan