Siemens SIMATIC TIM libcurl
SIMATIC TIM 1531 IRC devices are vulnerable to multiple vulnerabilities in the third party component libcurl that could allow an attacker to extract sensitive information and pass a revoked certificate as valid. Siemens has released an update for SIMATIC TIM 1531 IRC and recommends to update to the latest versions.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-8286US | high7.5 | — | ||
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. | ||||
| CVE-2020-8169US | high7.5 | — | ||
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s). | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-200951: Multiple Vulnerabilities in Third-Party Component libcurl of TIM Devices - CSAF Versionself
- SSA-200951: Multiple Vulnerabilities in Third-Party Component libcurl of TIM Devices - PDF Versionself
- SSA-200951: Multiple Vulnerabilities in Third-Party Component libcurl of TIM Devices - TXT Versionself
- ICS Advisory ICSA-21-159-10 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-21-159-10 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (4)
- MitigationSIMATIC TIM 1531 IRC (incl. SIPLUS NET variants)
Restrict access to the device to the internal or VPN network and to trusted IP addresses only
- MitigationSIMATIC TIM 1531 IRC (incl. SIPLUS NET variants)
Restrict access to the device to the internal or VPN network and to trusted IP addresses only
- BehobenSIMATIC TIM 1531 IRC (incl. SIPLUS NET variants)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109798331/ - BehobenSIMATIC TIM 1531 IRC (incl. SIPLUS NET variants)
Update to V2.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109798331/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan