Siemens SINUMERIK

🗓️ 09 Jun 2020 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 81 Views

Siemens SINUMERIK products are vulnerable to multiple severe security flaws including buffer underflow, heap-based overflow, improper initialization, and out-of-bounds read, leading to remote code execution, info disclosure, and DoS attacks

Reporter	Title	Published	Views	Family All 99
BDU FSTEC	The vulnerability of the VNC client of the remote desktop management software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VNC client of the remote desktop management software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the RRE decoder VNC client component of the remote desktop management software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the CoRRE decoder’s VNC client, a software tool for managing remote desktops like UltraVNC, allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ultra decoder component of the VNC client software for remote desktop management tools, UltraVNC, allows a intruder to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ultra2 decoder in the VNC client software for remote desktop management tools called UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VNC client of the remote desktop management software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ClientConnection::Copybuffer function in the VNC client of the remote desktop control software UltraVNC allows a hacker to execute arbitrary code.	16 Apr 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the ClientConnection::ReadString function in the VNC client component of the UltraVNC software, which is part of the monitoring, control, and remote maintenance module for commercial cold production equipment of TelevisGo, allows a perpetrator to execute arbitrary code.	19 May 202000:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the VNC client software for remote desktop management, UltraVNC, relates to writing beyond the buffer boundaries in memory. This allows a malicious actor to trigger a service failure.	30 Jul 202100:00	–	bdu_fstec

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-927095.html
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-161-06.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-161-06
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

09 Jun 2020 00:00Current

10High risk

Vulners AI Score10

CVSS 27.5

CVSS 39.8

CVSS 3.19.8

EPSS0.054