Yesterday CISA’s NCCIC-ICS published updates for ten control system security advisories for products from Rockwell and Siemens (9).
Rockwell Update
This update provides additional information on an advisory that was originally published on October 10th, 2020. This was originally published on the restricted HSIN site, so in effect this is the original public posting for this advisory.
This update describes five vulnerabilities in the Rockwell ISaGRAF5 Runtime product. The vulnerabilities were reported by Kaspersky. Rockwell has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The five reported vulnerabilities are:
Relative path traversal - CVE-2020-25176,
Unprotected storage of credentials - CVE-2020-25184,
Clear-text transmission of sensitive information - CVE-2020-25178,
Uncontrolled search path element - CVE-2020-25182, and
Use of hard-coded cryptographic key - CVE-2020-25180
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to may result in remote code execution, information disclosure, or a denial-of-service condition.
NOTE: These vulnerabilities affect GE Steam Power's ALSPA S6 MFC3000 and MFC1000 and may affect other vendor products that use ISaGRAF5 Runtime product.
PROFINET Update #1
This update provides additional information on an advisory that was originally published on May 9th, 2017 and most recently updated on March 9th, 2021. The new information includes adding SIMATIC ET200SP IM155-6 PN HS to the list of affected products.
Industrial Products Update #1
This update provides additional information on an advisory that was originally published on December 5th, 2017 and most recently updated on March 9th, 2021. The new information includes adding updated mitigation measures for SIMATIC ET200SP IM155-6 PN HS.
PROFINET Update #2
This update provides additional information on an advisory that was originally published on October 10th, 2019 and most recently updated on September 9th, 2020. The new information includes adding mitigation measures for SIMATIC ET200SP IM155-6 PN HS.
SIMATIC Update #1
This update provides additional information on an advisory that was originally published on September 8th, 2021. The new information includes:
Adding mitigation measures for Unified Comfort Panel, and
Adding generic workarounds for products that will not be remediated.
Industrial Products Update #2
This update provides additional information on an advisory that was originally published on September 8th, 2020 and most recently updated on April 13th, 2021. The new information includes adding mitigation measures for SIMATIC IPC527G.
SIMATIC Update #2
This update provides additional information on an advisory that was originally published on July 9th, 2020 and most recently updated on March 9th, 2021. The new information includes:
Adding mitigation measures for SIMATIC Automation Tool, and
Updating mitigation measures for SINEC NMS
Solid Edge Update
This update provides additional information on an advisory that was
SINAMICS Update
This update provides additional information on an advisory that was originally published on April 13th, 2021. The new information includes updating mitigation measures for CVE-2020-26997, CVE-2021-25678 and CVE-2021-27382.
Linux Based Products Update
This update provides additional information on an advisory that was originally published on May 11th, 2021. The new information includes adding mitigation measures for TIM 1531 IRC.
Other Siemens Updates
Siemens published two additional updates that I will discuss in my ICS Public Disclosures post this weekend.