SSA-232418

csafDEsiemens_psirt

SSA-232418: Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU Families

Advisory ansehen veröffentlicht 2019-08-13

Two vulnerabilities have been identified in the SIMATIC S7-1200/S7-1500 CPU families and related products. One vulnerability (CVE-2019-10943) could allow an attacker with network access to affected devices to modify the user program stored on these devices such that the source code differs from the actual running code. The other vulnerability (CVE-2019-10929) could allow an attacker in a Man- in-the-Middle position to modify network traffic exchanged on port 102/tcp. Siemens has released updates for several affected products to fix CVE-2019-10929 and recommends to update to the latest versions. Regarding CVE-2019-10943, Siemens recommends specific countermeasures for products where updates are not, or not yet available.

01

beschreibt (2)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2019-10943UShigh7.5OT erhöht—
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATI…
CVE-2019-10929USmedium5.9OT erhöht—
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open…
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (31)

  • MitigationSIMATIC Drive Controller family

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 Software Controller

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-1500 Software Controller

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-PLCSIM Advanced

    Apply password protection for S7 communication

  • MitigationSIMATIC S7-PLCSIM Advanced

    Apply password protection for S7 communication

  • Kein Fix geplantSIMATIC Drive Controller family

    Currently no fix is planned

  • Kein Fix geplantSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Currently no fix is planned

  • Kein Fix geplantSIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants)

    Currently no fix is planned

  • Kein Fix geplantSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-1500 Software Controller

    Currently no fix is planned

  • Kein Fix geplantSIMATIC S7-PLCSIM Advanced

    Currently no fix is planned

  • BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • BehobenSIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109759122/
  • BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Update to V4.4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • BehobenSIMATIC S7-1200 CPU family (incl. SIPLUS variants)

    Update to V4.4.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109793280/
  • BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Update to V2.8.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • BehobenSIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants)

    Update to V2.8.1 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109478459/
  • BehobenSIMATIC S7-1500 Software Controller

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772864/
  • BehobenSIMATIC S7-1500 Software Controller

    Update to V20.8 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772864/
  • BehobenSIMATIC S7-PLCSIM Advanced

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772889/
  • BehobenSIMATIC S7-PLCSIM Advanced

    Update to V3.0 or later version

    https://support.industry.siemens.com/cs/ww/en/view/109772889/
scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan