Today, CISA’s NCCIC-ICS published seven control system security advisories for products from Siemens (4), Siemens Electric, and Mitsubishi (2). They also published three updates for products from Mistusbishi, Siemens, and Trane.
SICAM Advisory #1
This advisory describes an unquoted search path or element vulnerability in their SICAM PQ Analyzer. The vulnerability is self-reported. Siemens has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to allow an attacker to achieve persistence on the system or cause a denial-of-service condition.
SICAM Advisory #2
This advisory describes two vulnerabilities in the Siemens SICAM A8000. The vulnerability was reported by Michael Messner of Siemens Energy. Siemens has a new version that mitigates the vulnerabilities. There is no indication that Messner has been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Use of hard-coded credentials - CVE-2021-45033, and
Improper access control - CVE-2021-45034
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow a privileged user to enable a debug port with default credentials and access to certain log files.
COMOS Advisory
This advisory describes four vulnerabilities in the Siemens COMOS Web unified data platform. The vulnerability was reported by Sandro Poppi. Siemens has a new version that mitigates the vulnerabilities. There is no indication that Poppi has been provided an opportunity to verify the efficacy of the fix.
The four reported vulnerabilities are:
Basic XSS - CVE-2021-37195,
Relative path traversal - CVE-2021-37196,
SQL injection - CVE-2021-37197, and
Cross-site request forgery - CVE-2021-37198
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow an attacker to conduct code injections, store data in undesired locations, execute arbitrary SQL statements, and run cross-site request forgery attacks.
SIPROTEC Advisory
This advisory describes an improper input validation vulnerability in the SIPROTEC 5 products. The vulnerability was self-reported. Siemens has a new version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an unauthenticated attacker to read device information.
Siemens Energy Advisory
This advisory discusses six of the NUCLEUS:13 vulnerabilities in the Siemens Electric PLUSCONTROL gen 1 products. The vulnerabilities were self-reported. Siemens provides generic workarounds with no mitigation measures planned.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to result in access to TFTP memory buffer contents, information leaks, and denial-of-service conditions.
MELSEC-F Advisory #1
This advisory describes an improper initialization vulnerability in the Mitsubishi MELSEC-F Series with FX3U-ENET Ethernet-Internet block. The vulnerability is self-reported. Mitsubishi has a new firmware version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to cause a denial-of-service condition in the affected product.
MELSEC-F Advisory #2
This advisory describes a lack of administrative control over security vulnerability in the Mitsubishi MELSEC-F Series with FX3U-ENET Ethernet-Internet block. The vulnerability is self-reported. Mitsubishi has a new firmware version that mitigates the vulnerability.
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to lead to a denial-of-service condition or cause other unspecified effects in the communication function of the product.
Mitsubishi Update
This update provides additional information on an advisory that was originally published on October 29th, 2020 and most recently updated on May 18th, 2021. The new information include updating the affected versions and providing mitigation measures for L 02/06/26 CPU (-P), L 26 CPU - (P) BT.
Siemens Update
This update provides additional information on an advisory that was originally published on April 14th, 2021. The new information includes removing CAPITAL VSTAR from the list of affected products.
NOTE: Siemens published an update for their version of this advisory on November 9th, 2021.
Trane Update
This update provides additional information on an advisory that was originally published on September 23rd, 2021. The new information includes removing the word ‘authenticated’ from the phrase “could allow an authenticated user to execute arbitrary code on the controller” in the ‘Risk Evaluation’ section of the advisory.
Other Siemens Updates
Siemens published six other updates yesterday that have not been covered by NCCIC-ICS. I will be covering them this weekend.