Siemens SIMATIC and TIM
The latest updates for the below mentioned products fix a vulnerability that allows an unauthenticated attacker to read PLC variables from affected devices without proper authentication under certain circumstances. Siemens has released updates for some of the affected products, is working on updates for the remaining affected products and recommends specific countermeasures until fixes are available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-28397US | medium5.3OT erhöht | — | ||
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All version… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-865327: Incorrect Authorization Vulnerability in Industrial Products - CSAF Versionself
- SSA-865327: Incorrect Authorization Vulnerability in Industrial Products - PDF Versionself
- SSA-865327: Incorrect Authorization Vulnerability in Industrial Products - TXT Versionself
- ICS Advisory ICSA-21-257-23 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-257-23 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (7)
- BehobenSIMATIC Drive Controller family
Update to V2.9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109773914/ - BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
Update to V21.9 or later version
https://support.industry.siemens.com/cs/ww/en/view/109759122/ - BehobenSIMATIC S7 PLCSIM Advanced
Updated to V4 or later version
https://support.industry.siemens.com/cs/de/en/view/109795016 - BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to V4.4.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793280 - BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)
Update to V2.9.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109478459/ - BehobenSIMATIC S7-1500 Software Controller
Update to V21.9 or later version
https://support.industry.siemens.com/cs/de/en/view/109478528/ - BehobenTIM 1531 IRC (incl. SIPLUS NET variants)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109798331
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan