SSA-693975: Denial-of-Service Vulnerability in the Web Server of Industrial Products
A vulnerability in the affected products could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial-of-service attack. Siemens has released a new version for SINAMICS S210 (6SL5...) and recommends to update to the latest version. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-38380US | — | — | ||
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 (incl. SIPLUS variants) (All versions < V3.4.29), SI… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- SSA-693975: Denial-of-Service Vulnerability in the Web Server of Industrial Products - CSAF Versionself
- SSA-693975: Denial-of-Service Vulnerability in the Web Server of Industrial Products - HTML Versionself
- SSA-693975: Denial-of-Service Vulnerability in the Web Server of Industrial Products - PDF Versionself
- SSA-693975: Denial-of-Service Vulnerability in the Web Server of Industrial Products - TXT Versionself
Behebungen (18)
- MitigationSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Restrict network access to the integrated webserver
- MitigationSIMATIC CP 1243-1 (incl. SIPLUS variants)
Restrict network access to the integrated webserver
- MitigationSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Restrict network access to the integrated webserver
- MitigationSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Restrict network access to the integrated webserver
- MitigationSIMATIC CP 1243-7 LTE
Restrict network access to the integrated webserver
- MitigationSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Restrict network access to the integrated webserver
- MitigationSIMATIC CP 1543-1 (6GK7543-1AX00-0XE0)
Restrict network access to the integrated webserver
- MitigationSINAMICS S210 (6SL5...)
Restrict network access to the integrated webserver
- MitigationSIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0)
Restrict network access to the integrated webserver
- Kein Fix geplantSIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants)
Currently no fix is planned
- BehobenSIMATIC CP 1242-7 V2 (incl. SIPLUS variants)
Update to V3.4.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823721/ - BehobenSIMATIC CP 1243-1 (incl. SIPLUS variants)
Update to V3.4.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823721/ - BehobenSIMATIC CP 1243-1 IEC (incl. SIPLUS variants)
Update to V3.4.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823721/ - BehobenSIMATIC CP 1243-7 LTE
Update to V3.4.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823721/ - BehobenSIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0)
Update to V3.4.29 or later version
https://support.industry.siemens.com/cs/ww/en/view/109823721/ - BehobenSIMATIC CP 1543-1 (6GK7543-1AX00-0XE0)
Update to V3.0.37 or later version
https://support.industry.siemens.com/cs/ww/en/view/109828349/ - BehobenSINAMICS S210 (6SL5...)
Update to V6.1 HF2 or later version
https://support.industry.siemens.com/cs/ww/en/view/109825153/ - BehobenSIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0)
Update to V3.0.37 or later version
https://support.industry.siemens.com/cs/ww/en/view/109828349/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan