Siemens UMC Stack (Update H)

🗓️ 14 Jul 2020 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 103 Views

Siemens UMC Stack (Update H) contains vulnerabilities including Unquoted Search Path, Uncontrolled Resource Consumption, and Improper Input Validation allowing for remote denial-of-service conditions and privilege escalation

Reporter	Title	Published	Views	Family All 33
BDU FSTEC	The vulnerabilities of the microprogramming software for Siemens STEP 7 programmable logic controllers, the systems for managing production processes such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT Production Suite, the system diagnostic tool SIMOCODE ES, the software for parameterizing, diagnosing, and documenting the startup process of SIRIUS Soft Starter ES, the web-based systems for managing technological processes like SIMATIC PCS neo, the Opcenter RD&L software platform, and the software for analyzing equipment efficiency and key indicators like SIMATIC IT LMS. These vulnerabilities arise from the absence of quotation marks in the wording of elements or search methods, which allows attackers to exploit them to gain elevated privileges to the root level.	12 Aug 202200:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities of microprogramming software for Siemens STEP 7 programmable logic controllers, systems for manufacturing process control such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT Production Suite, the system diagnostic tool SIMOCODE ES, the software for parameterizing, diagnosing, and documenting device startup data (SIRIUS Soft Starter ES), technological process control systems like SIMATIC PCS neo, the Opcenter RD&L software platform, and the software for analyzing equipment efficiency and key indicators SIMATIC IT LMS. These vulnerabilities may allow a intruder to trigger malfunctions during maintenance operations due to improper cleaning or resource release.	12 Aug 202200:00	–	bdu_fstec
BDU FSTEC	Vulnerability of microprogramming software for Siemens STEP 7 programmable logic controllers, systems for manufacturing process control such as Opcenter Execution Discrete, Opcenter Execution Process, Opcenter Execution Foundation, Opcenter Intelligence, Opcenter Quality, SIMATIC IT Production Suite, the system diagnostic tool SIMOCODE ES, the software for parameterizing, diagnosing, and documenting the startup status of SIRIUS Soft Starter ES, technological process management systems like SIMATIC PCS neo, the Opcenter RD&L software platform, and the software for analyzing equipment efficiency and key indicators like SIMATIC IT LMS. These vulnerabilities allow attackers to trigger malfunctions during maintenance operations due to insufficient input data verification.	12 Aug 202200:00	–	bdu_fstec
CNVD	Multiple Siemens Products Input Validation Error Vulnerability (CNVD-2021-54361)	12 Aug 202000:00	–	cnvd
CNVD	Resource Management Error Vulnerability in Multiple Siemens Products (CNVD-2021-54362)	15 Jul 202000:00	–	cnvd
CVE	CVE-2020-7581	14 Jul 202013:18	–	cve
CVE	CVE-2020-7587	14 Jul 202013:18	–	cve
CVE	CVE-2020-7588	14 Jul 202013:18	–	cve
Cvelist	CVE-2020-7581	14 Jul 202013:18	–	cvelist
Cvelist	CVE-2020-7587	14 Jul 202013:18	–	cvelist

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-841348.json
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-841348.txt
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-841348.pdf
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-196-05.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-196-05
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

14 Jul 2020 00:00Current

7.5High risk

Vulners AI Score7.5

CVSS 3.18.2

CVSS 27.2

EPSS0.02484