Today, CISA’s NCCIC-ICS published seventeen control system security advisories for products from Siemens (14), Red Lion, Johnson Controls, and Delta Electronics. They also published 22 updates for products from Siemens, but those will be covered in a subsequent post.
Mendix Advisory #1
This advisory describes an improper access control vulnerability in the Siemens Mendix software platform. The vulnerability was self-reported. Siemens has new versions that mitigate the vulnerability.
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow an authenticated attacker to extract information from a database protected field.
Mendix Advisor #2
This advisory describes exposure of sensitive information to an unauthorized actor vulnerability in the Siemens Mendix software platform. The vulnerability was self-reported. Siemens has a new version for Mendix 9, there is no fix planned for earlier products.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthenticated remote attacker to read sensitive data.
TIA Administrator Advisory
This advisory describes an uncontrolled resource consumption vulnerability in the Siemens TIA Administrator. The vulnerability was reported by Peter Cheng of Elex Feigong Research. Siemens has a new version for one of the affected products. There is no indication that Cheng was provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthenticated attacker to cause a denial-of-service condition.
Simcenter Advisory
This advisory describes three vulnerabilities in the Siemens Simcenter Femap simulation application. The vulnerabilities were reported by xina1i via the Zero Day Initiative. Siemens has a new version that mitigates the vulnerabilities. There is no indication that xina1i has been provided an opportunity to verify the efficacy of the fix.
The three reported vulnerabilities are:
Out-of-bounds read - CVE-2022-28661, and
Out-of-bounds write (2) - CVE-2022-28662 and CVE-2022-28663
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could remotely exploit the vulnerabilities to allow arbitrary code execution.
SIMATIC Advisory #1
This advisory describes an improper access control vulnerability in the Siemens SIMATIC STEP 7 (TIA Portal). The vulnerability was self-reported. Siemens has new updates for two of the affected versions; no fix is planned for version 15.
NCCIC-ICS reports that an uncharacterized attacker with direct access to the affected web server could exploit this vulnerability to attacker to achieve privilege escalation on the web server of certain devices configured by SIMATIC STEP 7 (TIA Portal) due to incorrect handling of the webserver’s user management configuration during downloading.
SIMATIC Advisory #2
This advisory describes a lengthy list of vulnerabilities (listed in this advisory as a single ‘use of unmaintained third-party components) in the Siemens GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP. These are GNU/Linux vulnerabilities, not strictly speaking ‘unmaintained third-party components. Siemens has periodically issued updates to fix the latest vulnerabilities, but the latest fix (for v2.94) is pending.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to crash the device being accessed; a buffer overflow condition may allow remote code execution.
NOTE: The Siemens version of this advisory was originally published in 2018 and most recently updated on March 8th, 2022. The list of GNU/Linux CVE’s is extensive to say the least.
SIMATIC Advisory #3
This advisory describes an improper restriction of operations within the bounds of a memory buffer vulnerability in the Siemens SIMATIC S7-400. The vulnerability is self-reported. Siemens has new versions for two of the four affected versions.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to create a denial-of-service condition.
SIMATIC Advisory #4
This advisory describes three vulnerabilities in the Siemens SIMATIC Energy Manager. The vulnerabilities were reported by Noam Moshe of Claroty. Siemens has new versions that mitigate the vulnerabilities. There is no indication that Moshe has been provided an opportunity to verify the efficacy of the fix.
The three reported vulnerabilities are:
Incorrect permission assignment for critical resource - CVE-2022-23448,
Uncontrolled search path element - CVE-2022-23449, and
Deserialization of untrusted data - CVE-2022-23450
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to obtain local/remote code execution and local privilege escalation.
SICAM Advisory
This advisory describes a missing authentication for critical function vulnerability in the Siemens SICAM A8000 products. The vulnerability was reported by Steffen Robertz, Gerhard Hechenberger, and Thomas Weber of SEC Consult Vulnerability Lab; the report includes proof-of-concept code. Siemens has a new version. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker to access files without authentication.
SCALANCE Advisory #1
This advisory describes nine vulnerabilities in the Siemens SCALANCE X-300 switch family devices. Two of the vulnerabilities were reported by Michael Messner and Abian Blome of Siemens Energy. Siemens has updates available to mitigate the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The nine reported vulnerabilities are:
Improper input validation - CVE-2022-25751,
Insufficiently random values - CVE-2022-25752,
Stack-based buffer overflow - CVE-2022-25753,
Cross-site request forgery - CVE-2022-25754,
Improper access control - CVE-2022-25755,
Basic XSS - CVE-2022-25756,
Classic buffer overflow - CVE-2022-26334 and CVE-2022-26335, and
Out-of-bounds read - CVE-2022-26380
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthenticated attacker to reboot, cause denial-of-service conditions, and impact the system by other means through buffer overflow vulnerabilities.
SCALANCE Advisory #2
This advisory describes three vulnerabilities in the Siemens SCALANCE W1700 wireless communications device. The vulnerabilities are self-reported. Siemens has new versions that mitigate the vulnerabilities.
The three reported vulnerabilities are:
Race condition, CVE-2022-27481, and
Improper input validation - CVE-2022-28328 and CVE-2022-28329
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit this vulnerability to allow an attacker to cause various denial-of-service conditions.
SCALANCE Advisory #3
This advisory discusses the FragAttacks WiFi vulnerabilities in the Siemens SCALANCE family devices. Siemens has new versions that mitigate the vulnerabilities.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an attacker within Wi-Fi range to forge encrypted frames, which could result in sensitive data disclosure and traffic manipulation.
NOTE: The Siemens version of this advisory was originally published on July 13th, 2021 and most recently updated on February 8th, 2022.
PROFINET Advisory
This advisory describes an uncontrolled resource consumption vulnerability in the Siemens PROFINET Stack Integrated on Interniche Stack. The vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow a denial-of-service condition.
OpenSSL Advisory
This advisory discusses a NULL pointer dereference vulnerability in the Siemens Industrial Products. This is a third-party (OpenSSL) vulnerability. Siemens has updated versions for many of the affected products.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthenticated attacker to cause a denial-of-service condition if a maliciously crafted renegotiation message is sent.
NOTE: The Siemens version of this advisory was originally published on December 10th, 2019 and most recently updated on February 17th, 2022.
Red Lion Advisory
This advisory describes four vulnerabilities in the Red Lion DA50N networking gateway. The vulnerabilities were reported by Ron Brash of aDolus Technology. The product is end-of-life and no fix is planned.
The four reported vulnerabilities are:
Insufficient verification of data authenticity - CVE-2022-26516,
Weak password requirements - CVE-2022-1039,
Use of unmaintained third-party components (Linux kernel v4.9.119) – No CVE, and
Insufficiently protected credentials - CVE-2022-27179
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to result in data compromise, data modification, and a denial-of-service condition.
Johnson Controls Advisory
This advisory describes an incomplete cleanup vulnerability in the Johnsons Controls Metasys ADS/ADX/OAS Servers. The vulnerabilities are self-reported. Johnson Controls has new versions that mitigate the vulnerability.
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow a remote attacker to use a session token that has not been cleared upon log out of an authenticated user.
Delta Advisory
This advisory describes an improper restriction of XML external entity reference vulnerability in the Delta DMARS, a Motion Controller program development tool. The vulnerability was reported by kimiya via ZDI. Delta has a new version that mitigates the vulnerability. There is no indication that kimiya has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to gain sensitive information.
Commentary
This month NCCIC-ICS published advisories for a couple of long-running advisories from Siemens. I am not sure where (CISA or Siemens) the housekeeping took place to see this happen, but this a small, but significant advance in information sharing that deserves mention.