SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400
SIDIS Prime before V4.0.400 is affected by multiple vulnerabilities in the components OPC UA and OpenSSL, that could allow an unauthenticated attacker with access to the network where SIDIS Prime is installed to reuse OPC UA client credentials, create a denial of service condition of the SIDIS Prime OPC UA client, or create a denial of service condition of the SIDIS Prime TLS service. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2022-29862US | high7.5 | — | ||
An infinite loop in OPC UA .NET Standard Stack 1.04.368 allows a remote attackers to cause the application to hang via a crafted message. | ||||
| CVE-2022-0778US | high7.5 | Exploit | ||
The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsi… | ||||
| CVE-2020-1971US | medium5.9 | Exploit | ||
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_c… | ||||
| CVE-2020-1967US | high7.5 | Exploit | ||
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect hand… | ||||
| CVE-2019-19135US | high7.4OT elevated | — | ||
In OPC Foundation OPC UA .NET Standard codebase 1.4.357.28, servers do not create sufficiently random numbers in OPCFoundation.NetStandard.Opc.Ua before 1.4.359.31, which allows ma… | ||||
references
External citations — patches, advisories, analysis.
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - CSAF Versionself
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - HTML Versionself
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - PDF Versionself
- SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 - TXT Versionself
remediations (6)
- MitigationSIDIS Prime
CVE-2019-19135: Enable encrypted communication between the affected product (OPC UA client) and the OPC UA server(s)
- FixedSIDIS Prime
Update to V4.0.400 or later version
- FixedSIDIS Prime
Update to V4.0.400 or later version
- FixedSIDIS Prime
Update to V4.0.400 or later version
- FixedSIDIS Prime
Update to V4.0.400 or later version
- FixedSIDIS Prime
Update to V4.0.400 or later version
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan