For Part 2 we have 2nd Tuesday vendor disclosures and updates from Siemens and Schneider that were not addressed earlier by CISA’s NCCIC-ICS. We have two vendor disclosures from Schneider (all of the Siemens original disclosures were covered by CISA this month). We also have fourteen updates from Siemens (10) and Schneider (4). Finally, we have a Schneider security bulletin addressing the INCONTROLLER ICS attack tools.
Schneider Advisories
Schneider published an advisory describing a buffer copy without checking size of input vulnerability in the Data Server module for their IGSS (Interactive Graphical SCADA System) product. The vulnerability was reported by ADLab of Venustech. Schneider has a new version that mitigates the vulnerability. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
Schneider published an advisory describing an improper privilege management vulnerability in their Modicon M340 Controller and Communication Modules. The vulnerability was reported by Peter Cheng from Elex Feigong Research Institute. Schneider has a new version of the M340 Controller that mitigates the vulnerability. There is no indication that Cheng has been provided an opportunity to verify the efficacy of the fix.
Siemens Updates
Siemens published an update for their OpenSSL advisory that was originally reported on July 13th, 2021 and most recently updated on March 8th, 2022. The new information includes adding solutions for:
RUGGEDCOM RCM1224 family,
SCALANCE M-800 family,
SCALANCE MUM-800 family,
SCALANCE S615,
SCALANCE X-300/X408 family,
SIMATIC PCS neo,
SIMATIC Process Historian OPC UA Server,
SCALANCE W-1700 (11AC) family,
SIMATIC CP 1543-1, and
SIPLUS NET CP 1543-1
Siemens published an update for their SIMATIC advisory that was originally published on March 29th, 2018 and most recently updated on March 12th, 2019. The new information includes:
Adding solution for SIMATIC NET PC Software V14, and
Clarifying affected versions
NOTE: NCCIC-ICS has not updated their advisory (ICSA-18-088-03) for this new information.
Siemens published an update for their TCP SACK PANIC advisory that was originally published on September 10th, 2019 and most recently updated on March 8th, 2022.
NOTE: NCCIC-ICS did update their advisory (ICSA-19-253-03) for this new information, but did not list it on their ICS Archive page to let the public know about the update.
Siemens published an update for their SIMATIC advisory that was originally published on March 8th, 2022. The new information includes adding solutions for:
SCALANCE S615,
SCALANCE M-800 Family,
SCALANCE
MUM-800 Family,
RUGGEDCOM RM1224 family,
SIMATIC CP 1543-1, and
SIPLUS NET CP 1543-1
Siemens published an update for their SegmentSmack advisory that was originally published on April 14th, 2020 and most recently updated on March 28th, 2022. The new information includes a cleanup due to template changes, no change of contents.
Siemens published an update for their Log4Shell Advisory that was originally published on December 13th, 2021 and most recently updated on March 8th, 2022. The new information includes:
Adding solution for NX,
Confirming that SIMATIC IT Report Manager is not affected, and
Removing section “Products Under Investigation”
Siemens published an update for their OpenSSH advisory that was originally published on September 14th, 2021. The new information includes adding solution for SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants).
Siemens published an update for their OpenSSL advisory that was originally published on December 10th, 2019 and most recently updated on February 17th, 2022. The new information includes:
Adding solution for SIMATIC S7-1200 CPU family V1.8 (2022-04-12),
Announcing that no fix planned for SINAMICS Connect 300,
Adding solution for SCALANCE M-800/ S615 family, RUGGEDCOM RM1224, and SCALANCE W-1700 IEEE 802.11ac family,and
Adding SIMATIC RF600R family to the list of affected products.
NOTE: NCCIC-ICS did not update their advisory (ICSA-19-099-06) for these changes.
Siemens published an update for their PROFINET advisory that was originally published on February 11th, 2020 and most recently updated on February 8th, 2022. The new information includes adding solution for SCALANCE X-300 switch family (incl. X408 and SIPLUS NET variants).
Siemens published an update for their FragAttacks advisory that was originally published on July 13th, 2021 and most recently updated on February 8th, 2022. The new information includes adding solution for the SCALANCE W-1700 (11ac) family.
Schneider Updates
Schneider published an update for their EcoStruxure advisory that was originally published on July 13th, 2021 and most recently updated on March 8th, 2022. The new information includes adding that a release is available for Modicon M340 controllers that addresses CVE-2021-22779.
Schneider published an update for their CODESYS advisory that was originally published on January 11th, 2022 and most recently updated on February 8th, 2022. The new information includes adding final remediations for Eurotherm E+PLC400, Eurotherm E+PLC tools, and Eurotherm E+PLC100.
Schneider published an update for their ATT Labs Compressor advisory that was originally published on August 10th, 2021 and most recently updated on March 9th, 2022. The new information includes adding remediation for EcoStruxure™ Control Expert V15.1 HF001 and EcoStruxure™ Process Expert V2021
Schneider published an update for their Embedded FTP Servers advisory that was originally published on March 22nd, 2018 and most recently updated on May 11th, 2021. The new information includes:
Adding a fix for Modicon M340 V3.50 that addresses CVE-2018-7242, and
Updating the list of affected products for CVE-2018-7240, CVE-2018-7241 and CVE-2011- 4859.
Schneider Bulletin
On Wednesday, Schneider published a security bulletin discussing the INCONTROLLER ICS attack tools that target Schneider PLCs (among others). Schneider provides a list of potentially affected products and then provides generic workarounds to mitigate the effects of these tools.