Auma: SIMA² Master Station Denial of Service Vulnerability on Automation Runtime Webserver
Improper buffer restrictions in the webserver used in SIMA² Master Station software versions < V 2.6 may allow an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of service.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-22275US | high8.6 | — | ||
Buffer Overflow vulnerability in B&R Automation Runtime webserver allows an unauthenticated network-based attacker to stop the cyclic program on the device and cause a denial of se… | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationFirmware <v2.6 installed on SIMA² Master Station
AUMA recommends the following specific workarounds and mitigations: The access to the SIMA² should be restricted to legitimate network partners, using e.g. a sufficient firewall setup and robust network segmentation. In general, AUMA recommends implementing the Product Security Guideline for uses on Cybersecurity for the SIMA² Master Station.
- FixedFirmware <v2.6 installed on SIMA² Master Station
The described vulnerabilities have been fixed in the product versions with software version V 2.6 or higher. SIMA² Master Stations with software versions < V 2.6 can be upgraded. AUMA recommends applying a product update at the earliest convenience
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan