Siemens SIMATIC WinCC
Before SIMATIC WinCC V8, legacy OPC services (OPC DA (Data Access), OPC HDA (Historical Data Access), and OPC AE (Alarms & Events)) were used per default. These services were designed on top of the Windows ActiveX and DCOM mechanisms and do not implement state-of-the-art security mechanisms for authentication and encryption of contents. Starting with WinCC V8.0 the legacy OPC services are no longer enabled by default in new installations. Siemens recommends to use OPC UA instead and to disable the legacy OPC services. For deployments where the legacy OPC services are still in use, ensure that only trusted users are part of the SIMATIC HMI group.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-28829US | high8.8 | — | ||
A vulnerability has been identified in SIMATIC NET PC Software V14 (All versions), SIMATIC NET PC Software V15 (All versions), SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-508677: Use of Obsolete Function Vulnerability in SIMATIC WinCC before V8 - CSAF Versionself
- SSA-508677: Use of Obsolete Function Vulnerability in SIMATIC WinCC before V8 - HTML Versionself
- SSA-508677: Use of Obsolete Function Vulnerability in SIMATIC WinCC before V8 - PDF Versionself
- SSA-508677: Use of Obsolete Function Vulnerability in SIMATIC WinCC before V8 - TXT Versionself
- ICS Advisory ICSA-23-166-05 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-23-166-05 - Web Versionself
- Recommended Practicesexternal
Behebungen (21)
- MitigationSIMATIC NET PC Software V14
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- MitigationSIMATIC NET PC Software V15
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- MitigationSIMATIC PCS 7 V8.2
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- MitigationSIMATIC PCS 7 V9.0
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- MitigationSIMATIC PCS 7 V9.1
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- MitigationSIMATIC WinCC
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- MitigationSINAUT Software ST7sc
Disable the legacy OPC DA/HDA/AE services and switch to OPC UA, if possible
- Kein Fix geplantSIMATIC NET PC Software V14
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V15
Currently no fix is planned
- Kein Fix geplantSIMATIC PCS 7 V8.2
Currently no fix is planned
- Kein Fix geplantSIMATIC PCS 7 V9.0
Currently no fix is planned
- Kein Fix geplantSIMATIC PCS 7 V9.1
Currently no fix is planned
- Kein Fix geplantSINAUT Software ST7sc
Currently no fix is planned
- BehobenSIMATIC WinCC
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816599/ - WorkaroundSIMATIC NET PC Software V14
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
- WorkaroundSIMATIC NET PC Software V15
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
- WorkaroundSIMATIC PCS 7 V8.2
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
- WorkaroundSIMATIC PCS 7 V9.0
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
- WorkaroundSIMATIC PCS 7 V9.1
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
- WorkaroundSIMATIC WinCC
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
- WorkaroundSINAUT Software ST7sc
SINATIC NET PC Software: Ensure that only trusted users are part of the SIMATIC Net group
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan