CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
88.5%
CVSS v3 10.0
ATTENTION: Exploitable remotely/low skill level to exploit
Vendor: Siemens
Equipment: SINUMERIK Controllers
Vulnerabilities: Heap-based Buffer Overflow, Integer Overflow or Wraparound, Protection Mechanism Failure, Permissions, Privileges, and Access Controls, Stack-based Buffer Overflow, Uncaught Exception
This updated advisory is a follow-up to the original advisory titled ICSA-18-345-02 Siemens SINUMERIK Controllers that was published December 11, 2018, on the NCCIC/ICS-CERT website.
Successful exploitation of these vulnerabilities could cause denial-of-service conditions, privilege escalation, or allow remote code execution.
Siemens reports the vulnerabilities affect the following versions of the SINUMERIK CNC controllers:
--------- Begin Update A Part 1 of 2 ---------
--------- End Update A Part 1 of 2 ---------
Some products are not affected by all of the vulnerabilities. Please see Siemens advisory SSA-170881 for additional details.
Sending specially crafted network requests to Port 4842/TCP of the integrated web server could allow a remote attacker to execute code with privileged permissions.
This vulnerability is only exploitable if Port 4842/TCP is manually opened in the firewall configuration of network Port X130.
CVE-2018-11457 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Sending specially crafted network requests to Port 5900/TCP of the integrated VNC server could allow a remote attacker to execute code with privileged permissions.
This vulnerability is only exploitable if Port 5900/TCP is manually opened in the firewall configuration of network Port X130.
CVE-2018-11458 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A local attacker could modify a user-writeable configuration file so that after reboot or manual initiation, the attacker-controlled code is executed with elevated privileges.
CVE-2018-11459 has been assigned to this vulnerability. A CVSS v3 base score of 7.0 has been calculated; the CVSS vector string is (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with elevated user privileges (manufact) could modify a CRAMFS archive so that after reboot, the system loads the modified CRAMFS file and attacker-controlled code is executed with root privileges.
CVE-2018-11460 has been assigned to this vulnerability. A CVSS v3 base score of 6.7 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
A local attacker with user privileges could use the service command application for privilege escalation to an elevated user, but not root.
CVE-2018-11461 has been assigned to this vulnerability. A CVSS v3 base score of 6.6 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).
By sending a specially crafted authentication request to affected systems, a remote attacker could escalate privileges to an elevated user account, but not to root.
CVE-2018-11462 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
A buffer overflow in the service command application could allow a local attacker to execute code with elevated privileges.
CVE-2018-11463 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
The integrated VNC server on Port 5900/TCP of the affected products could allow a remote attacker to cause a denial-of-service condition of the VNC server.
This vulnerability is only exploitable if Port 5900/TCP is manually opened in the firewall configuration of network Port X130.
CVE-2018-11464 has been assigned to this vulnerability. A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
A local attacker could use ioctl calls to do out of bounds reads, arbitrary writes, or execute code in kernel mode.
CVE-2018-11465 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Specially crafted network packets sent to Port 102/TCP (ISO-TSAP) could allow a remote attacker to cause a denial-of-service condition of the integrated software firewall, or allow to execute code in the context of the software firewall.
CVE-2018-11466 has been assigned to this vulnerability. A CVSS v3 base score of 10.0 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
β’ ** CRITICAL INFRASTRUCTURE SECTORS:** Critical Manufacturing
β’ **COUNTRIES/AREAS DEPLOYED:**Worldwide
β’ COMPANY HEADQUARTERS LOCATION: Germany
Siemens working with Anton Kalinin, Danila Parnishchev, Dmitry Sklyar, Gleb Gritsai, Kirill Nesterov, Radu Motspan, and Sergey Sidorov from Kaspersky Lab reported these vulnerabilities to NCCIC.
--------- Begin Update A Part 2 of 2 ---------
Siemens recommends updating affected devices as soon as possible. See below for details.
--------- End Update A Part 2 of 2 ---------
Contact a Siemens account manager to obtain updates for SINUMERIK software.
Siemens recommends affected users implement the following specific workarounds and mitigations to reduce risk:
For additional information see Siemensβ security advisory SSA-170881 at the following location:
<http://www.siemens.com/cert/en/cert-security-advisories.htm>
As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemensβ operational guidelines for industrial security, and following the recommendations in the product manuals.
<https://www.siemens.com/cert/operational-guidelines-industrial-security>
Additional information on Industrial Security by Siemens can be found at:
<https://www.siemens.com/Industrialsecurity>
NCCIC recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
NCCIC reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
NCCIC also provides a section for control systems security recommended practices on the ICS-CERT web page. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS-CERT website in the technical information paper, ICS-TIP-12-146-01BβTargeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to NCCIC for tracking and correlation against other incidents.
NCCIC also recommends that users take the following measures to protect themselves from social engineering attacks:
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11457
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11458
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11459
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11460
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11461
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11462
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11463
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11464
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11465
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-11466
www.siemens.com/cert/en/cert-security-advisories.htm
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-advisories/icsa-18-345-02
cwe.mitre.org/data/definitions/121.html
cwe.mitre.org/data/definitions/122.html
cwe.mitre.org/data/definitions/190.html
cwe.mitre.org/data/definitions/248.html
cwe.mitre.org/data/definitions/248.html
cwe.mitre.org/data/definitions/248.html
cwe.mitre.org/data/definitions/264.html
cwe.mitre.org/data/definitions/264.html
cwe.mitre.org/data/definitions/693.html
cwe.mitre.org/data/definitions/693.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=Siemens%20SINUMERIK%20Controllers%20%28Update%20A%29+https://www.cisa.gov/news-events/ics-advisories/icsa-18-345-02
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-18-345-02&title=Siemens%20SINUMERIK%20Controllers%20%28Update%20A%29
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-18-345-02
www.oig.dhs.gov/
www.siemens.com/cert/operational-guidelines-industrial-security
www.siemens.com/Industrialsecurity
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Siemens%20SINUMERIK%20Controllers%20%28Update%20A%29&body=www.cisa.gov/news-events/ics-advisories/icsa-18-345-02
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:M/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
Low
EPSS
Percentile
88.5%