Siemens SIMATIC S7-1200 (Update A)
SIMATIC S7-1200 PLC, version V4.5.0 fails to authenticate against configured passwords when the affected device was provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC. Siemens has released an update for SIMATIC S7-1200 and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-37172US | high7.5 | — | ||
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisio… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-830194: Missing Authentication Vulnerability in S7-1200 Devices - CSAF Versionself
- SSA-830194: Missing Authentication Vulnerability in S7-1200 Devices - PDF Versionself
- SSA-830194: Missing Authentication Vulnerability in S7-1200 Devices - TXT Versionself
- ICS Advisory ICSA-21-222-09 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-222-09 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (2)
- MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to TIA Portal V13 SP1 or any later version before provisioning S7-1200 V4.5.0 devices
- BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to V4.5.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793280/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan