SSA-042050: Know-How Protection Mechanism Failure in TIA Portal
The know-how protection feature in Totally Integrated Automation Portal (TIA Portal) does not properly update the encryption of existing program blocks when a project file is updated. This could allow attackers with access to the project file to recover previous - yet unprotected - versions of the project without the knowledge of the know-how protection password. Siemens recommends specific countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-30757US | medium5.5 | — | ||
A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V14 (All versions), Totally Integrated Automation Portal (TIA Portal) V15 (All versions), T… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (16)
- MitigationTotally Integrated Automation Portal (TIA Portal) V14
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109742284?c=87347935883)
- MitigationTotally Integrated Automation Portal (TIA Portal) V15
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109764516?c=105012867723)
- MitigationTotally Integrated Automation Portal (TIA Portal) V15.1
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109755202?c=105012867723)
- MitigationTotally Integrated Automation Portal (TIA Portal) V16
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109773506?c=126979557387)
- MitigationTotally Integrated Automation Portal (TIA Portal) V17
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109798671?c=132780438283)
- MitigationTotally Integrated Automation Portal (TIA Portal) V18
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/mdm/109815056?c=132780438283)
- MitigationTotally Integrated Automation Portal (TIA Portal) V19
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapters "Security information" and "Protecting Blocks" in the system manual ( https://support.industry.siemens.com/cs/ww/en/view/109826862/)
- MitigationTotally Integrated Automation Portal (TIA Portal) V20
Archive the project: the optimization of project data during archiving removes older, possibly unprotected project content; see also the chapter "Protecting Blocks" in the system manual ( https://docs.tia.siemens.cloud/r/en-us/v20/protecting-blocks)
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V14
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V15
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V15.1
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V16
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V17
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V18
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V19
Currently no fix is planned
- Kein Fix geplantTotally Integrated Automation Portal (TIA Portal) V20
Currently no fix is planned
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan