SSA-830194: Missing Authentication Vulnerability in S7-1200 Devices
SIMATIC S7-1200 PLC, version V4.5.0 fails to authenticate against configured passwords when the affected device was provisioned using TIA Portal V13. This could allow an attacker using TIA Portal V13 or later versions to bypass authentication and download arbitrary programs to the PLC. Siemens has released an update for SIMATIC S7-1200 and recommends to update to the latest version.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-37172US | high7.5 | — | ||
A vulnerability has been identified in SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (V4.5.0). Affected devices fail to authenticate against configured passwords when provisio… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (2)
- MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to TIA Portal V13 SP1 or any later version before provisioning S7-1200 V4.5.0 devices
- BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)
Update to V4.5.1 or later version
https://support.industry.siemens.com/cs/ww/en/view/109793280/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan