SSA-285795: Denial of Service in OPC-UA in Industrial Products
A vulnerability in the underlying third party component OPC UA ANSIC Stack (also called Legacy C-Stack) affects several industrial products. The vulnerability could cause a crash of the component that includes the vulnerable part of the stack. Siemens has released updates for the affected products and recommends to update to the latest versions.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-45117US | medium6.5 | — | ||
The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference. | ||||
references
External citations — patches, advisories, analysis.
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - CSAF Versionself
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - HTML Versionself
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - PDF Versionself
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - TXT Versionself
remediations (18)
- MitigationSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V14
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V15
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V16
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V17
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSITOP Manager
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationTeleControl Server Basic V3
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- No fix plannedSIMATIC NET PC Software V15
Currently no fix is planned
- FixedSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer
https://support.industry.siemens.com/cs/ww/en/view/109746530/ - FixedSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer
https://support.industry.siemens.com/cs/ww/en/view/109746530/ - FixedSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer
https://support.industry.siemens.com/cs/ww/en/view/109746530/ - FixedSIMATIC NET PC Software V14
Update to V14 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807351/ - FixedSIMATIC NET PC Software V16
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811815/ - FixedSIMATIC NET PC Software V17
Update to V17 SP1 or later version
- FixedSITOP Manager
Update to V1.2.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109760607/ - FixedTeleControl Server Basic V3
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812231/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan