Siemens OPC Foundation Local Discovery Server Affecting Siemens Products
A vulnerability was identified in OPC Foundation Local Discovery Server which also affects Siemens products that could allow an attacker to escalate privileges under certain circumstances. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-44725US | high7.8 | — | ||
OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is l… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-691715: Vulnerability in OPC Foundation Local Discovery Server Affecting Siemens Products - CSAF Versionself
- SSA-691715: Vulnerability in OPC Foundation Local Discovery Server Affecting Siemens Products - HTML Versionself
- ICS Advisory ICSA-24-102-08 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-102-08 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (24)
- MitigationOpenPCS 7 V9.1
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC NET PC Software V14
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC NET PC Software V15
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC NET PC Software V16
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC NET PC Software V17
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC NET PC Software V18
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC Process Historian 2020 OPC UA Server
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC Process Historian 2022 OPC UA Server
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC WinCC
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC WinCC Runtime Professional
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationSIMATIC WinCC Unified PC Runtime V18
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- MitigationTeleControl Server Basic V3
Update the underlying OPC Foundation Unified Architecture Local Discovery Server (UA-LDS) to [V1.04.405](https://opcfoundation.org/developer-tools/samples-and-tools-unified-architecture/local-discovery-server-lds/) or later if possible
- Kein Fix geplantOpenPCS 7 V9.1
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V14
Currently no fix is planned
- Kein Fix geplantSIMATIC NET PC Software V15
Currently no fix is planned
- Kein Fix geplantSIMATIC Process Historian 2020 OPC UA Server
Currently no fix is planned
- BehobenSIMATIC NET PC Software V16
Update to V16 Update 8 or later version
https://support.industry.siemens.com/cs/ww/en/view/109974091/ - BehobenSIMATIC NET PC Software V17
Update to V17 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109820674/ - BehobenSIMATIC NET PC Software V18
Update to V18 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109826242/ - BehobenSIMATIC Process Historian 2022 OPC UA Server
In the context of SIMATIC PCS neo, update to SIMATIC PCS neo V4.1 or later version
- BehobenSIMATIC WinCC
Update to V8.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/109816599/ - BehobenSIMATIC WinCC Runtime Professional
Update to V18 Update 2 or later version
- BehobenSIMATIC WinCC Unified PC Runtime V18
Update to V18.0 SP1 Update 1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109807123/ - BehobenTeleControl Server Basic V3
Update to V3.1.2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109955177/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan