Siemens Mentor Nucleus Networking Module
The DHCP implementation of the networking component (Nucleus NET) in Nucleus Real-Time Operating System (RTOS) contains a vulnerability that could allow an attacker to change the IP address of an affected device to an invalid value. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2019-13939US | medium4.8 | — | ||
A vulnerability has been identified in APOGEE MEC/MBC/PXC (P2) (All versions < V2.8.2), APOGEE PXC Compact (BACnet) (All versions < V3.5.3), APOGEE PXC Compact (P2 Ethernet) (All v… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-434032: Input Validation Vulnerability in the DHCP Client of Nucleus RTOS - CSAF Versionself
- SSA-434032: Input Validation Vulnerability in the DHCP Client of Nucleus RTOS - HTML Versionself
- ICS Advisory ICSA-19-318-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-19-318-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (10)
- MitigationCapital Embedded AR Classic 431-422
Avoid using DHCP Client of Nucleus NET
- MitigationCapital Embedded AR Classic R20-11
Avoid using DHCP Client of Nucleus NET
- MitigationNucleus NET
Avoid using DHCP Client of Nucleus NET
- MitigationNucleus ReadyStart V3
Avoid using DHCP Client of Nucleus NET
- MitigationNucleus Source Code
Avoid using DHCP Client of Nucleus NET
- Kein Fix geplantCapital Embedded AR Classic 431-422
Currently no fix is planned
- Kein Fix geplantNucleus NET
Currently no fix is planned
- BehobenCapital Embedded AR Classic R20-11
Update to V2303 or later version
- BehobenNucleus ReadyStart V3
Update to V2017.02.3 or later version
- BehobenNucleus Source Code
Contact customer support to receive patch and update information
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan