Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products (Update C)

CVSS v3 6.8

Vendor: Siemens

Equipment: SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products

Vulnerabilities: Security Features

UPDATE INFORMATION

This updated advisory is a follow-up to the updated advisory titled ICSA-17-318-01B Siemens SCALANCE, SIMATIC, RUGGEDCOM, and SINAMICS Products that was published December 19, 2017, on the NCCIC/ICS-CERT web site.

AFFECTED PRODUCTS

--------- Begin Update C Part 1 of 2 ----------

Siemens reports that the key reinstallation attacks (KRACK) potentially affect the following Siemens industrial products:

• SCALANCE W1750D: All versions,
• SCALANCE WLC711: All versions prior to V9.21.19.003,
• SCALANCE WLC712: All versions prior to V9.21.19.003,
• SCALANCE W-700 (IEEE 802.11n): All versions prior to V6.2.1,
• SCALANCE W-700 (IEEE 802.11a/b/g): All versions,
• SIMATIC IWLAN-PB/LINK: All versions,
• RUGGEDCOM RX1400 with WLAN interface: All versions prior to V2.11.2,
• RUGGEDCOM RS9xxW: All versions,
• SIMATIC Mobile Panel 277(F) IWLAN: All versions,
• SIMATIC ET200 PRO IM154-6 PN IWLAN: All versions,
• SINAMICS V20 Smart Access Module: All versions,
• SIMATIC RF350M: All versions with Summit Client Utility prior to V22.3.5.16, and
• SIMATIC RF650M: All versions with Summit Client Utility prior to V22.3.5.16.

--------- End Update C Part 1 of 2 ----------

IMPACT

Successful exploitation of these vulnerabilities could potentially allow an attacker within the radio range of the wireless network to decrypt, replay, or inject forged network packets into the wireless communication.

MITIGATION

--------- Begin Update C Part 2 of 2 --------

Siemens has provided the following updates to address the vulnerabilities in the affected products:

• SCALANCE W-700 (IEEE 802.11n): Install V6.2.1:

<https://support.industry.siemens.com/cs/ww/en/view/109752596&gt;

• RUGGEDCOM ROX II for RX1400 with WLAN interface: Install V2.11.2:

Contact the RUGGEDCOM support team at: <https://support.industry.siemens.com/my/WW/en/requests#createRequest&gt;

• SIMATIC RF350M and SIMATIC RF650M: V22.3.5.16 from:

<https://support.industry.siemens.com/cs/ww/en/view/109752556&gt;

• SCALANCE WLC711 and SCALANCE WLC712: Install V9.21.19.003:

<https://support.industry.siemens.com/cs/ww/en/view/109755170&gt;

--------- End Update C Part 2 of 2 ----------

SCALANCE W1750D devices are not vulnerable in the default configuration. Only users who enable the “Mesh” or “WiFi uplink” functionality are affected by the vulnerabilities. Disabling these functionalities will completely mitigate the vulnerabilities.

SCALANCE WLC711 and WLC712 can deactivate IEEE 802.11r, “MeshConnect,” and “Client Bridge Mode” to reduce the risk, provided these modes have been activated and are not required for the operation of the wireless environment. All three functions are turned off by default.

SCALANCE W-700 standalone Access Points, RUGGEDCOM RX1400 and RS9xxW, are not vulnerable if operated in Access Point mode.

SCALANCE W-700 standalone devices, SIMATIC Mobile Panel 277F IWLAN, and SIMATIC ET200 WLAN, are not affected if the iPCF, iPCF-MC, or iPCF-HT features are enabled.

For the remaining affected products or if the mitigations outlined previously cannot be implemented, Siemens recommends the following mitigations in the meantime:

• Ensure multiple layers of security. Do not depend on the security of WPA2 alone.
• Use WPA2-CCMP (AES) instead of WPA2-TKIP or WPA-GCMP, if supported by the WLAN clients, to reduce the risk of potential attacks.
• Apply defense-in-depth.

<https://www.siemens.com/cert/operational-guidelines-industrial-security&gt;

For more information on this vulnerability and more detailed mitigation instructions, please see Siemens Security Advisories SSA-901333 and SSA-418456 at the following location:

<http://www.siemens.com/cert/en/cert-security-advisories.htm&gt;

NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available in the NCCIC Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies, that is available for download from the ICS-CERT web site.

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.

These vulnerabilities have been publicly disclosed. These vulnerabilities are exploitable from an adjacent network. High skill level is needed to exploit.

VULNERABILITY OVERVIEW

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) allows reinstallation of the pairwise key in the four-way handshake.

CVE-2017-13077 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) allows reinstallation of the group temporal key (GTK) during the four-way handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVE-2017-13078 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the integrity group temporal key (IGTK) during the four-way handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVE-2017-13079 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) allows reinstallation of the group temporal key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients.

CVE-2017-13080 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11w allows reinstallation of the integrity group temporal key (IGTK) during the group key handshake, allowing an attacker within radio range to spoof frames from access points to clients.

CVE-2017-13081 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the pairwise transient key (PTK) temporal key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVE-2017-13082 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) allows reinstallation of the station-to-station-link (STSL) transient key (STK) during the PeerKey handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVE-2017-13084 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) allows reinstallation of the tunneled direct-link setup (TDLS) peer key (TPK) during the TDLS handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

CVE-2017-13086 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) that support 802.11v allows reinstallation of the group temporal key (GTK) when processing a wireless network management (WNM) sleep mode response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVE-2017-13087 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

SECURITY FEATURES CWE-254

Wi-Fi protected access (WPA and WPA2) that support 802.11v allows reinstallation of the integrity group temporal key (IGTK) when processing a wireless network management (WNM) sleep mode response frame, allowing an attacker within radio range to replay frames from access points to clients.

CVE-2017-13088 has been assigned to this vulnerability. A CVSS v3 base score of 4.2 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N).

RESEARCHER

Mathy Vanhoef, of the Katholieke Universiteit Leuven in Belgium, discovered these vulnerabilities.

BACKGROUND

Critical Infrastructure Sectors: Chemical, Energy, Food and Agriculture, Healthcare and Public Health, Transportation Systems, and Water and Wastewater Systems

Countries/Areas Deployed: Worldwide

Company Headquarters Location: Germany