Today CISA’s NCCIC-ICS published nine control system security advisories for products from Siemens. They also published nine advisory updates; I will address them separately.
SIMATIC Advisory
This advisory describes an improper authentication vulnerability in the Siemens SIMATIC S7-1200 Devices. The vulnerability was reported by Jian Gao. Siemens has a new version that mitigates the vulnerability. There is no indication that Gao has been provide an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to allow an attacker using TIA Portal v17 or later versions to bypass authentication and download arbitrary programs to the PLC.
Solid Edge Advisory
This advisory describes three vulnerabilities in the Siemens Solid Edge products. The vulnerabilities were reported by Xina1i via the Zero Day Initiative. Siemens has an update that mitigates the vulnerabilities. There is no indication that Xinali has been provided an opportunity to verify the efficacy of the fix.
The three reported vulnerabilities:
Improper restriction of XML external entity reference - CVE-2021-37178,
Use after free - CVE-2021-37179,
Access of uninitialized pointer - CVE-2021-37180
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to lead the application to crash, or to arbitrary code execution and data extraction on the target host system.
SIMATIC Net Advisory
This advisory describes two vulnerabilities in the Siemens SIMATIC products. The vulnerabilities are self-reported. Siemens has a new version that mitigates the vulnerabilities.
The two reported vulnerabilities are:
Out-of-bounds read - CVE-2020-9272, and
Use after free - CVE-2020-9273
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerabilities to allow a remote attacker to access sensitive information and execute arbitrary code.
Energy Solutions Advisory
This advisory describes an out-of-bounds write vulnerability in the Siemens Energy SGT Solutions. This is a third-party vulnerability (Rockwell, VxWorks, this is one of the NAME:WRECK vulnerabilities).
NCCIC-ICS reports that a relatively low-skilled attacker could remotely exploit the vulnerability to lead to remote code execution.
NOTE 1: The vulnerability was first written up (with proof-of-concept code) in 2016 and reported to VxWorks. I did not try to find the VxWorks advisory because Siemens specifically states that their problem is related to the Rockwell products.
NOTE 2: Both the NCCIC-ICS and Siemens advisories name the Siemens AGT products in the title of the advisories, but do not include them in the list of affected products.
Comment – The NCCIC-ICS does not mention either the Rockwell nexus explained by Siemens nor the connection to the NAME:WRECK vulnerabilities. Interestingly, neither does the NIST listing for the CVE (CVE-2016-20009).
Industrial Products Advisory
This advisory describes twelve instances of missing encryption of a sensitive data vulnerability in the Siemens SIMATIC and SINUMERIK products. These are third-party (Intel) vulnerabilities. Siemens recommends updating the Intel BIOS for four of the affected products. No workaround or mitigations are available for the remaining products.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit these vulnerabilities to lead to unauthorized access to sensitive data, privilege escalation, and configuration change.
SINEC Advisory
This advisory describes an OS command injection vulnerability in the Siemens SINEC NMS. The vulnerability was reported by Sharon Brizinov from Claroty. Siemens has an update that mitigates the vulnerability. There is no indication that Brizinov has been provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reported that a relatively low-skilled attacker could remotely exploit the vulnerability to allow an authenticated remote attacker with system privileges to execute arbitrary code on the system under certain conditions.
JT2Go Advisory #1
This advisory describes three vulnerabilities in the Siemens JT2Go and Teamcenter Visualization products. Two of the three vulnerabilities are third-party (Open Design Alliance) vulnerabilities. The vulnerabilities were reported by Mat Powell via ZDI. Siemens has new versions that mitigate the vulnerabilities. There is no indication that Powell was provided an opportunity to verify the efficacy of the fix.
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerability to result in an application crash or arbitrary code execution.
Automation License Advisory
This advisory describes an uncontrolled resource consumption vulnerability in the Siemens Automation License Manager. The vulnerability was self-reported. Siemens has an update that mitigates the vulnerability.
NCCIC-ICS reports that an uncharacterized attacker could remotely exploit the vulnerability to cause a denial-of-service condition, preventing legitimate users from accessing the system.
JT2Go Advisory #2
This advisory describes seven vulnerabilities in the Siemens JT2Go and Teamcenter Visualization products. Six of the seven vulnerabilities are third-party (Open Design Alliance) vulnerabilities. The vulnerabilities were reported by Mat Powell and Brian Gorenc of ZDI, and Kai Wang from Qi’anxin Group. Siemens has updates that mitigate the vulnerabilities. There is no indication that the researchers were provided an opportunity to verify the efficacy of the fix.
The seven reported vulnerabilities are:
Use after free - CVE-2021-32944,
Out-of-bounds write (2) - CVE-2021-32936 and CVE-2021-32948,
Out-of-bounds read (3) - CVE-2021-32938, CVE-2021-32940, and CVE-2021-32950,
Null pointer dereference - CVE-2021-33717
NCCIC-ICS reports that a relatively low-skilled attacker with uncharacterized access could exploit the vulnerabilities to allow an attacker to crash an application or execute arbitrary code.
Another Siemens Advisory
Siemens published one other advisory today. If NCCIC-ICS does not cover that Thursday, it will be covered here this weekend.