Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2020.2015.2 Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK vulnerabilities 13 January 2021 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Siemens SIMATIC Siemens SINAMICS Siemens SINEC Siemens SINEMA Siemens SINUMERIK Publisher: ICS-CERT Operating System: Network Appliance Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Increased Privileges -- Existing Account Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2020-7586 CVE-2020-7585 CVE-2020-7580 CVE-2019-8280 CVE-2019-8277 CVE-2019-8276 CVE-2019-8275 CVE-2019-8274 CVE-2019-8273 CVE-2019-8272 CVE-2019-8271 CVE-2019-8270 CVE-2019-8269 CVE-2019-8268 CVE-2019-8267 CVE-2019-8266 CVE-2019-8265 CVE-2019-8264 CVE-2019-8263 CVE-2019-8262 CVE-2019-8261 CVE-2019-8260 CVE-2019-8259 CVE-2019-8258 CVE-2018-15361 Original Bulletin: https://www.us-cert.gov/ics/advisories/icsa-20-161-04 https://www.us-cert.gov/ics/advisories/icsa-20-161-05 https://www.us-cert.gov/ics/advisories/icsa-20-161-06 Comment: This bulletin contains three (3) ICS-CERT security advisories. Revision History: January 13 2021: Update E released for ICSA-20-161-04 June 10 2020: Initial Release - --------------------------BEGIN INCLUDED TEXT-------------------- ICS Advisory (ICSA-20-161-04) Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update E) Original release date: January 12, 2021 Legal Notice All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 6.7 o ATTENTION: Low skill level to exploit o Vendor: Siemens o Equipment: SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK o Vulnerability: Unquoted Search Path or Element 2. UPDATE INFORMATION This updated advisory is a follow-up to the advisory update titled ICSA-20-161-04 Siemens SIMATIC, SINAMICS, SINEC, SINEMA, SINUMERIK (Update D) that was published December 8, 2020, to the ICS webpage on us-cert.cisa.gov. 3. RISK EVALUATION Successful exploitation of this vulnerability could allow authorized local users with administrative privileges to execute custom code with SYSTEM level privileges. 4. TECHNICAL DETAILS 4.1 AFFECTED PRODUCTS The following Siemens products are affected: o SIMATIC Automation Tool: All versions o SIMATIC NET PC software: All versions after v16 and prior to v16 Upd3 o SIMATIC PCS neo: All versions prior to v3.0 SP1 o SIMATIC ProSave: All versions o SIMATIC S7-1500 Software Controller: All versions prior to v21.8 o SINAMICS STARTER: All versions prior to v5.4 HF2 o SIMATIC STEP 7: All versions prior to v5.6 SP2 HF3 o SIMATIC STEP 7 (TIA Portal) v13: All versions prior to SP2 Update 4 - --------- Begin Update E Part 1 of 2 --------- o SIMATIC STEP 7 (TIA Portal) v14: All versions prior to v14 SP1 Update 10 o SIMATIC WinCC Runtime Professional v14: All versions prior to v14 SP1 Update 10 - --------- End Update E Part 1 of 2 --------- o SIMATIC STEP 7 (TIA Portal) v15: All versions prior to v15.1 Update 5 o SIMATIC STEP 7 (TIA Portal) v16: All versions prior to v16 Update 2 o SIMATIC WinCC OA v3.16: All versions prior to P018 o SIMATIC WinCC OA v3.17: All versions prior to P003 o SIMATIC WinCC Runtime Advanced: All versions prior to v16 Update 2 o SIMATIC WinCC Runtime Professional v13: All versions prior to v13 SP2 Update 4 o SIMATIC WinCC Runtime Professional v14: All versions o SIMATIC WinCC Runtime Professional v15: All versions prior to v15.1 Update 5 o SIMATIC WinCC Runtime Professional v16: All versions prior to v16 Update 2 o SIMATIC WinCC v7.4: All versions prior to v7.4 SP1 Update 14 o SIMATIC WinCC v7.5: All versions prior to v7.5 SP1 Update 3 o SINAMICS Startdrive: All versions o SINEC NMS: All versions o SINEMA Server: All versions o SINUMERIK ONE virtual: All versions o SINUMERIK Operate: All versions 4.2 VULNERABILITY OVERVIEW 4.2.1 UNQUOTED SEARCH PATH OR ELEMENT CWE-428 The affected product is vulnerable due to a component within the affected application that regularly calls a helper binary with SYSTEM privileges while the call path is not quoted, potentially allowing an attacker to execute commands with elevated privileges. CVE-2020-7580 has been assigned to this vulnerability. A CVSS v3 base score of 6.7 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:H/UI:N/S:U/ C:H/I:H/A:H ). 4.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture, Water and Wastewater Systems o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY HEADQUARTERS LOCATION: Germany 4.4 RESEARCHER Ander Martinez of Titanium Industrial Security and INCIBE reported this vulnerability to Siemens. 5. MITIGATIONS Siemens recommends applying updates, where available: o SIMATIC NET PC software: Update to v16 Upd3 o SIMATIC PCS neo: Update to v3.0 SP1 (Contact your local support to obtain update software) o SIMATIC STEP 7: Update to v5.6 SP2 HF3 o SIMATIC WinCC OA v3.16: Update to v3.15-P018 or newer o SIMATIC WinCC OA v3.17: Update to v3.17-P003 or newer o SIMATIC WinCC v7.4: Update to v7.4 SP1 Update 14 o SIMATIC WinCC v7.5: Update to v7.5 SP1 Update 3 o SINEC NMS: Install provided patch o SINEMA Server: Install provided patch - --------- Begin Update E Part 2 of 2 --------- o SIMATIC STEP 7 (TIA Portal) v14: Update to v14 SP1 Update 10 o SIMATIC WinCC Runtime Professional v14: Update to v14 SP1 Update 10 - --------- End Update E Part 2 of 2 --------- Siemens has identified the following specific workarounds and mitigations that can be applied to reduce the risk: o Ensure there is no executable at the following locations: C:\Program.exe C:\Program Files\Common.exe C:\Program Files\Common Files\Siemens\Automation\Simatic.exe o Deactivate the Windows service called TraceConceptX. This leads to loss of tracing functionality and should only be considered a temporary workaround. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens operational guidelines for Industrial Security and following the recommendations in the product manuals. For additional information, please refer to Siemens Security Advisory SSA-312271 CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov . Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents. This vulnerability is not exploitable remotely. No known public exploits specifically target this vulnerability. For any questions related to this report, please contact the CISA at: Email: CISAservicedesk@cisa.dhs.gov Toll Free: 1-888-282-0870 CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product. - -------------------------------------------------------------------------------- ICS Advisory (ICSA-20-161-05) Siemens SIMATIC, SINAMICS Original release date: June 09, 2020 Legal Notice All information products included in https://us-cert.gov/ics are provided"as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://www.us-cert.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 7.8 o ATTENTION: Low skill level to exploit o Vendor: Siemens o Equipment: SIMATIC, SINAMICS o Vulnerabilities: Uncontrolled Search Path Element, Heap-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to affect the availability of the devices under certain conditions. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Siemens products are affected: o SIMATIC PCS 7: All versions o SIMATIC PDM: All versions o SIMATIC STEP 7 v5.X: All versions prior to 5.6 SP2 HF3 o SINAMICS STARTER (containing STEP 7 OEM version): All versions prior to 5.4 HF1 3.2 VULNERABILITY OVERVIEW 3.2.1 UNCONTROLLED SEARCH PATH ELEMENT CWE-427 The affected product is vulnerable to DLL hijacking, which may allow an attacker with local access to execute code with elevated privileges. CVE-2020-7585 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/ C:H/I:H/A:H ). 3.2.2 HEAP-BASED BUFFER OVERFLOW CWE-122 The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker with local access to cause a denial-of-service condition. CVE-2020-7586 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is ( AV:L/AC:L/PR:L/UI:N/S:U/ C:H/I:H/A:H ). 3.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture, Water and Wastewater Systems o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY HEADQUARTERS LOCATION: Germany 3.4 RESEARCHER Nadav Erez of Claroty reported these vulnerabilities to Siemens. 4. MITIGATIONS Siemens recommends applying updates, where available: o SIMATIC STEP 7 v5.X: Update to v5.6 SP2 HF3 or later o SINAMICS STARTER (containing STEP 7 OEM version): Update to v5.4 HF1 or later Siemens recommends the following to reduce the risk: o Restrict access to project files on the engineering station to trusted users. o Only use project files from trusted sources. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens operational guidelines for Industrial Security and following the recommendations in the product manuals. For additional information, please refer to Siemens Security Advisory SSA-689942 CISA recommends users take the following measures to protect themselves from social engineering attacks: o Do not click web links or open unsolicited attachments in email messages. o Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams. o Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov . Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. These vulnerabilities are not exploitable remotely. For any questions related to this report, please contact the CISA at: Email: CISAservicedesk@cisa.dhs.gov Toll Free: 1-888-282-0870 CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product. - -------------------------------------------------------------------------------- ICS Advisory (ICSA-20-161-06) Siemens SINUMERIK Original release date: June 09, 2020 Legal Notice All information products included in https://us-cert.gov/ics are provided"as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://www.us-cert.gov/tlp/ . 1. EXECUTIVE SUMMARY o CVSS v3 9.8 o ATTENTION: Exploitable remotely/low skill level to exploit o Vendor: Siemens o Equipment: SINUMERIK o Vulnerabilities: Buffer Underflow, Heap-based Buffer Overflow, Improper Initialization, Out-of-bounds Read, Stack-based Buffer Overflow, Access of Memory Location After End of Buffer, Off-by-one Error, Improper Null Termination, Improper Initialization 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow remote code execution, information disclosure, and denial-of-service attacks under certain conditions. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS Siemens reports the vulnerabilities affect the following SINUMERIK products: o SINUMERIK Access MyMachine/P2P: All versions prior to 4.8 o SINUMERIK PCU base Win10 software/IPC: All versions prior to 14.00 o SINUMERIK PCU base Win7 software/IPC: All versions prior to 12.01 HF4 3.2 VULNERABILITY OVERVIEW 3.2.1 BUFFER UNDERWRITE ('BUFFER UNDERFLOW') CWE-124 The affected products are vulnerable to a buffer underwrite in VNC client code, which may allow an attacker to remotely execute arbitrary code. CVE-2018-15361 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.2 HEAP-BASED BUFFER OVERFLOW CWE-122 The affected products are vulnerable to a heap-based buffer overflow, which may result in code execution. CVE-2019-8258 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.3 IMPROPER INITIALIZATION CWE-665 The affected products contain multiple memory leaks in VNC client code, which allow an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. CVE-2019-8259 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:N/A:N ). 3.2.4 OUT-OF-BOUNDS READ CWE-125 There is an out-of-bounds read vulnerability in VNC client decoder code caused by multiplication overflow. CVE-2019-8260 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.5 OUT-OF-BOUNDS READ CWE-125 The affected products have an out-of-bounds read vulnerability in VNC code inside the client decoder, caused by multiplication overflow. CVE-2019-8261 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.6 HEAP-BASED BUFFER OVERFLOW CWE-122 The affected products have multiple heap buffer overflow vulnerabilities in VNC client code inside Ultra decoder, which results in code execution. CVE-2019-8262 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.7 STACK-BASED BUFFER OVERFLOW CWE-121 The affected products are vulnerable to a stack-based buffer overflow, which leads to a denial-of-service condition. User interaction is required to trigger this vulnerability. CVE-2019-8263 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:R/S:U/ C:N/I:N/A:H ). 3.2.8 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788 The affected products are vulnerable due to out-of-bounds access, which can potentially result in code execution. CVE-2019-8264 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.9 A ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788 The affected products are vulnerable to multiple out-of-bounds access vulnerabilities connected with usage of a macro in the VNC client code, which can potentially result in code execution. CVE-2019-8265 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.10 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788 The affected products have multiple out-of-bounds access vulnerabilities connected with improper usage of functions in the VNC client code, which can potentially result in code execution. CVE-2019-8266 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.11 OUT-OF-BOUNDS READ CWE-125 The affected products are vulnerable due to an out-of-bounds read in the VNC client code, which may result in a denial-of-service condition. CVE-2019-8267 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:N/I:N/A:H ). 3.2.12 OFF-BY-ONE ERROR CWE-193 The affected products have multiple off-by-one vulnerabilities in VNC client code connected with improper usage of functions, which can potentially result code execution. CVE-2019-8268 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.13 STACK-BASED BUFFER OVERFLOW CWE-121 The affected products are vulnerable to a stack-based buffer overflow in the VNC client code, which may allow an attacker to perform a denial of service condition. CVE-2019-8269 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( V:N/AC:L/PR:N/UI:N/S:U/C:N /I:N/A:H ). 3.2.14 OUT-OF-BOUNDS READ CWE-125 The affected products have an out-of-bounds read vulnerability in VNC client code inside Ultra decoder, which results in a denial-of-service condition. CVE-2019-8270 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( V:N/AC:L/PR:N/UI:N/S:U/C:N /I:N/A:H ). 3.2.15 HEAP-BASED BUFFER OVERFLOW CWE-122 The affected products are vulnerable to a heap-based buffer overflow in the VNC server code inside the file transfer handler, which can potentially result in code execution. CVE-2019-8271 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.16 OFF-BY-ONE ERROR CWE-193 The affected products are vulnerable to multiple off-by-one errors in the VNC server code, which may allow an attacker to execute arbitrary code. CVE-2019-8272 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.17 HEAP-BASED BUFFER OVERFLOW CWE-122 The affected products are vulnerable to a heap-based buffer overflow in the VNC server code inside the file transfer request handler, which can potentially result in code execution. CVE-2019-8273 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.18 HEAP-BASED BUFFER OVERFLOW CWE-122 The affected products have a heap buffer overflow vulnerability in VNC server code inside file transfer offer handler, which can potentially in result code execution. CVE-2019-8274 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.19 IMPROPER NULL TERMINATION CWE-170 There is an improper null termination in the VNC server code, which may allow remote access to out-of-bounds data. CVE-2019-8275 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.2.20 STACK-BASED BUFFER OVERFLOW CWE-121 The affected products are vulnerable to a stack-based buffer overflow in the VNC server code, which can result in denial of service. CVE-2019-8276 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:N/I:N/A:H ). 3.2.21 IMPROPER INITIALIZATION CWE-665 The affected products contain multiple memory leaks in VNC server code, which allows an attacker to read stack memory and can be abused for information disclosure. Combined with another vulnerability, it can be used to leak stack memory and bypass ASLR. CVE-2019-8277 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:N/A:N ). 3.2.22 ACCESS OF MEMORY LOCATION AFTER END OF BUFFER CWE-788 The affected products are vulnerable to out-of-bounds access in the VNC client, which can potentially allow code execution. CVE-2019-8280 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is ( AV:N/AC:L/PR:N/UI:N/S:U/ C:H/I:H/A:H ). 3.3 BACKGROUND o CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture, Water and Wastewater Systems o COUNTRIES/AREAS DEPLOYED: Worldwide o COMPANY HEADQUARTERS LOCATION: Germany 3.4 RESEARCHER Siemens reported these vulnerabilities to CISA. 4. MITIGATIONS Siemens has released updates for the affected products and recommends users update to the latest versions: o SINUMERIK Access MyMachine/P2P: Update to v4.8 (SINUMERIK software can be obtained from a Siemens account manager) o SINUMERIK PCU base Win10 software/IPC: Update to v14.00 (SINUMERIK software can be obtained from a Siemens account manager) o SINUMERIK PCU base Win7 software/IPC: Update to v12.01 HF4 (SINUMERIK software can be obtained from a Siemens account manager) Siemens recommends the following to help reduce risk: o Restrict access to the device to the internal or VPN network and to trusted IP addresses only. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens operational guidelines for Industrial Security and following the recommendations in the product manuals. For additional information, please refer to Siemens Security Advisory SSA-927095 CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should: o Minimize network exposure for all control system devices and/or systems, and ensure that they are not accessible from the Internet . o Locate control system networks and remote devices behind firewalls, and isolate them from the business network. o When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing that VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize that VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov . Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies . Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies . Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents. No known public exploits specifically target these vulnerabilities. For any questions related to this report, please contact the CISA at: Email: CISAservicedesk@cisa.dhs.gov Toll Free: 1-888-282-0870 CISA continuously strives to improve its products and services. You can help by choosing one of the links below to provide feedback about this product. - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBX/6m6eNLKJtyKPYoAQim7xAAgp34dIyLirXbeKPiC6qq7ZQW3+RSBZu+ /1h/VEDumxJxev4bHrtVWHsekYs6Pn5xFGQhl0KBtlIm6lPNi6C+C0lSE5yOswMM eandr+HQECH9ESOFMwQQ3zTi+d6Ws8OzGzMroH9C+U82nos2aPvd9yzy1Hcc/T1f mGAxpLL/0sqGY+ZIh6YAfCSDLsKoYc+GozwJxOmMSUyZuC89A5LbcqCvng+AmzBL qVHLw3ryCnGd9la9tSzVwW5GRrVVsDj2u+RSO3PUbN4f0oE20bgkGyGZSt0PIpWr MTma9Q0MzxZFDxHHVQ+J0niN3GbgRqzTXRFSn9b4ei0fEDyVqlzKMBDHupTPGv07 YTgw8olJb6Qp395M2BayIP2mz4sTezskZzvcrvPgwFKcxVsU2uv6U/lL0MZf2e+Y i7PuWdpkLa18KqwXUnrz6hkU1kLz8vNM4/lICDrxCQoe69qfG5WdhXM1aX/2/Q2b 5oYsHijxl8a5YkdzW2eu2FSAR6XDRS97L8Rj4RXg0wTpymFVpEBR5cH8M9gp/cbL HRFSGktLO1WwZyRCOjhYkYRs1h55ZNyz0j9Ah+s5wuTZeSq7EhY6pp8pbH7uByIe DasnDElL71Rn3Px0i8ZO2fwm6SOZIW6SqCIUcyPUygN8YHszcBBc5VFjRihHrOuY Iopig5yMma8= =kscP -----END PGP SIGNATURE-----