Siemens SIMATIC SmartVNC HMI WinCC Products (Update B)

🗓️ 11 May 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 80 Views

Siemens SmartVNC HMI WinCC Products (Update B) has 9.8 CVSS score, allows remote code execution, information disclosure, and denial-of-service attacks due to memory access vulnerabilities. Affected products: SIMATIC HMI Comfort Outdoor Panels v15 7’ and 15’, SIMATIC HMI Comfort Panels v15 4’-22’, SIMATIC HMI KTP Mobile Panels v15 KTP400F, KTP700, KTP700F, KTP900, KTP900F, SIMATIC WinCC Runtime Advanced v15, SIMATIC HMI Comfort Outdoor Panels v16 7’ and 15’, SIMATIC HMI Comfort Panels v16 4’-22’, SIMATIC HMI KTP Mobile Panels v16 KTP400F, KTP700, KTP700F, KTP900, KTP900F, SIMATIC WinCC Runtime Advanced v16

Reporter	Title	Published	Views	Family All 70
BDU FSTEC	The vulnerabilities of Siemens SIMATIC and SINAMICS software products allow a perpetrator to execute arbitrary code.	24 Dec 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogramming software in Siemens SIMATIC and SINAMICS products, related to a memory release error, allows attackers to trigger malfunctions during maintenance operations.	28 Jun 202300:00	–	bdu_fstec
CNNVD	Siemens SIMATIC WinCC 缓冲区错误漏洞	11 May 202100:00	–	cnnvd
CNNVD	Siemens SIMATIC WinCC 缓冲区错误漏洞	11 May 202100:00	–	cnnvd
CNNVD	Siemens SIMATIC WinCC 安全漏洞	11 May 202100:00	–	cnnvd
CNNVD	Siemens SIMATIC WinCC 安全漏洞	11 May 202100:00	–	cnnvd
CNNVD	Siemens SIMATIC WinCC 安全漏洞	11 May 202100:00	–	cnnvd
CNNVD	Siemens SmartVNC 缓冲区错误漏洞	11 May 202100:00	–	cnnvd
CNNVD	Siemens SmartVNC 资源管理错误漏洞	11 May 202100:00	–	cnnvd
CNVD	Siemens SmartVNC Buffer Overflow Vulnerability	19 May 202100:00	–	cnvd

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-538778.json
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-538778.txt
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-131-12.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-131-12
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

11 May 2021 00:00Current

8.9High risk

Vulners AI Score8.9

CVSS 27.5

CVSS 3.19.8

EPSS0.01937

SSVC