This updated advisory is a follow-up to the advisory titled ICSA-15-202-03A Siemens RUGGEDCOM ROS and ROX Based Devices TLS POODLE Vulnerability that was published July 25, 2015, on the NCCIC/ICS-CERT web site.
Siemens has reported to ICS-CERT that a Transport Layer Security (TLS) Padding Oracle On Downgraded Legacy Encryption (POODLE) vulnerability exists in the web interface of Siemens RUGGEDCOM ROS and ROX-based devices. Siemens has produced a firmware update to mitigate this vulnerability.
This vulnerability could be exploited remotely.
The following Siemens RUGGEDCOM ROS versions are affected:
Note – ROX I devices are not affected
Successful exploitation of this vulnerability may allow attackers to hijack an active web session and access administrative functions on the devices without proper authorization or allow unprivileged users to perform privilege escalation.
Impact to individual organizations depends on many factors that are unique to each organization. ICS-CERT recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation.
Siemens is an international company headquartered in Munich, Germany.
The affected products, Siemens RuggedCom ROS and ROX-based devices, are used to connect devices that operate in harsh environments such as electric utility substations and traffic control cabinets. According to Siemens, RuggedCom ROS and ROX-based devices are deployed across several sectors including Energy, Healthcare and Public Health, and Transportation Systems. Siemens estimates that these products are used worldwide.
The web interface (Port 443/TCP) of the affected devices is vulnerable to a padding oracle attack (also known as TLS POODLE). A remote attacker in a privileged network position could possibly recover parts of the plain text if unsuspecting users are misled to click on a malicious link.
CVE-2015-5537b has been assigned to this vulnerability. A CVSS v2 base score of 4.3 has been assigned; the CVSS vector string is (AV:N/AC:M/Au:N/C:P/I:N/A:N).c
Exploitation of this vulnerability could allow remote attackers to recover parts of the plaintext of an encrypted connection under certain circumstances. This vulnerability can be staged remotely but cannot be exploited without user interaction. The exploit is only triggered when a local user voluntarily interacts with the attack mechanism.
No known public exploits specifically target this vulnerability.
Crafting a working exploit for this vulnerability would be difficult. Social engineering is required to convince the user to accept the malformed file. Additional user interaction is needed to load the malformed file. This decreases the likelihood of a successful exploit.
Siemens has produced a firmware update v4.2.0 for ROS-based devices and firmware update v2.9.0 for ROX II-based devices, which fixes the vulnerability.
The firmware updates for the affected products can be obtained online at:
Call a local hotline center:
Asset owners and operators should contact Siemens customer support to acquire the update.
For more information on this vulnerability and detailed instructions, please see Siemens Security Advisory SSA-396873 at the following location:
ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
ICS-CERT also provides a section for control systems security recommended practices on the ICS-CERT web page at: <http://ics-cert.us-cert.gov/content/recommended-practices>. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available in the ICS‑CERT Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site (<http://ics-cert.us-cert.gov/>).
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to ICS-CERT for tracking and correlation against other incidents.
In addition, ICS-CERT recommends that users take the following measures to protect themselves from social engineering attacks: