Siemens Industrial Products with OPC UA
A vulnerability in the underlying third party component OPC UA ANSIC Stack (also called Legacy C-Stack) affects several industrial products. The vulnerability could cause a crash of the component that includes the vulnerable part of the stack. Siemens has released updates for the affected products and recommends to update to the latest versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-45117US | medium6.5 | — | ||
The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL pointer dereference. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - CSAF Versionself
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - HTML Versionself
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - PDF Versionself
- SSA-285795: Denial of Service in OPC-UA in Industrial Products - TXT Versionself
- ICS Advisory ICSA-22-132-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-22-132-08 - Web Versionself
- Recommended Practicesexternal
Behebungen (18)
- MitigationSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V14
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V15
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V16
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSIMATIC NET PC Software V17
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationSITOP Manager
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- MitigationTeleControl Server Basic V3
Do not use OPC client feature to connect via untrusted networks or to untrusted OPC-UA communication partners
- Kein Fix geplantSIMATIC NET PC Software V15
Currently no fix is planned
- BehobenSIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer
https://support.industry.siemens.com/cs/ww/en/view/109746530/ - BehobenSIMATIC HMI Comfort Panels (incl. SIPLUS variants)
Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer
https://support.industry.siemens.com/cs/ww/en/view/109746530/ - BehobenSIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F
Update SIMATIC WinCC (TIA Portal) to V17 Update 5 or newer, and then update panel to V17 Update 5 or newer
https://support.industry.siemens.com/cs/ww/en/view/109746530/ - BehobenSIMATIC NET PC Software V14
Update to V14 SP1 Update 14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807351/ - BehobenSIMATIC NET PC Software V16
Update to V16 Update 6 or later version
https://support.industry.siemens.com/cs/ww/en/view/109811815/ - BehobenSIMATIC NET PC Software V17
Update to V17 SP1 or later version
- BehobenSITOP Manager
Update to V1.2.4 or later version
https://support.industry.siemens.com/cs/ww/en/view/109760607/ - BehobenTeleControl Server Basic V3
Update to V3.1.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109812231/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan