Yesterday Siemens published two control system security advisories and five updates just nine days after their regular 2nd Tuesday publication of advisories and updates.
Siemens Advisories
Siemens published an advisory discussing the Wibu Systems CodeMeter vulnerabilities in their Energy Products. These vulnerabilities were previously reported by Siemens in SSA- 455843. Siemens has patches that mitigate the vulnerabilities.
Siemens published an advisory describing two vulnerabilities in their Simcenter Femap advanced simulation application. These vulnerabilities were reported by the Zero Day Initiative. Siemens has a new version that mitigates the vulnerabilities. There is no indication that the researchers have been provided an opportunity to verify the efficacy of the fix.
The two reported vulnerabilities are:
Out-of-bounds write - CVE-2021-46162, and
Stack-based buffer overflow - CVE-2021-46699
Siemens Updates
Siemens published an update for their OpenSSL advisory that was originally reported on July 13th, 2021 and most recently updated on February 8th, 2022. The new information includes adding SIMATIC S7 1200 CPU family and SCALANCE W-700 IEEE 802.11ax family.
Siemens published an update for their SPPA-T3000 advisory that was originally published on December 17th, 2019 and most recently updated on March 10th, 2020. The new information includes assigning the advisory to Siemens Energy.
NOTE: NCCIC-ICS did not update their advisory (ICSA-19-351-02) for these changes.
Siemens published an update for their Wibu Systems CodeMeter Advisory that was originally published in 2018 and most recently updated on March 13th, 2021. The new information includes moving Siemens Energy Products to a separate advisory (see above).
NOTE: NCCIC-ICS did not update their advisory (ICSA-20-203-01) for these changes.
Siemens published an update for their Ripple20 advisory that was originally published on July 14th, 2020. The new information includes assigning the advisory to Siemens Energy.
Siemens published an update for their OpenSSL in Industrial Products advisory that was originally published on December 10th, 2019 and most recently updated on February 8th, 2022. The new information includes adding solution for SIMATIC S7-1200 CPU family.
NOTE: NCCIC-ICS did not update their advisory (ICSA-19-099-06) for these changes.