Siemens SIMATIC and SIMIT
Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in several industrial products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the OPC UA server. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-52891US | — | — | ||
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (All versions < V7.5), SIMATIC IPC DiagBase (All versions), SI… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-088132: Denial of Service Vulnerability in the OPC UA Server Implementations of Several Industrial Products - CSAF Versionself
- SSA-088132: Denial of Service Vulnerability in the OPC UA Server Implementations of Several Industrial Products - HTML Versionself
- ICS Advisory ICSA-24-193-07 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-193-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (12)
- MitigationSIMATIC Energy Manager Basic
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
- MitigationSIMATIC Energy Manager PRO
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
- MitigationSIMATIC IPC DiagBase
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
- MitigationSIMATIC IPC DiagMonitor
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
- MitigationSIMIT V10
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
- MitigationSIMIT V11
Disable the OPC UA server in the affected product, if possible and OPC UA is not used
- Kein Fix geplantSIMATIC IPC DiagBase
Currently no fix is planned
- Kein Fix geplantSIMATIC IPC DiagMonitor
Currently no fix is planned
- Kein Fix geplantSIMIT V10
Currently no fix is planned
- BehobenSIMATIC Energy Manager Basic
Update to V7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827289/ - BehobenSIMATIC Energy Manager PRO
Update to V7.5 or later version
https://support.industry.siemens.com/cs/ww/en/view/109827289/ - BehobenSIMIT V11
Update to V11.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820441/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan