SSA-686975: IPU 2022.3 Vulnerabilities in Siemens Industrial Products using Intel CPUs
Intel has published information on vulnerabilities in Intel products in November 2022. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update ("2022.3 IPU – BIOS Advisory" Intel-SA-00688). Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-21198US | medium6.4 | — | ||
Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local acces… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (28)
- MitigationSIMATIC Field PG M5
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC Field PG M6
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC BX-39A
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC PX-39A
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC PX-39A PRO
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC427E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC477E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC477E Pro
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC627E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC647E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC677E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC IPC847E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIMATIC ITP1000
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- MitigationSIPLUS IPC427E
As a prerequisite for an attack, an attacker must be able to run untrusted code on affected systems. Siemens recommends limiting the possibilities to run untrusted code if possible.
- Kein Fix geplantSIMATIC ITP1000
Currently no fix is planned
- BehobenSIMATIC Field PG M5
Update to V22.01.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC Field PG M6
Update to V26.01.11 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC BX-39A
Update to V29.01.03 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC PX-39A
Update to V29.01.03 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC PX-39A PRO
Update to V29.01.03 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC427E
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC477E
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC477E Pro
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC627E
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC647E
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC677E
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIMATIC IPC847E
Update to V25.02.14 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/ - BehobenSIPLUS IPC427E
Update to V21.01.19 or later version
https://support.industry.siemens.com/cs/ww/en/view/109763408/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan