Siemens SIMATIC SmartVNC HMI WinCC Products (Update B)

🗓️ 11 May 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 129 Views

Siemens SmartVNC HMI WinCC Products (Update B) has 9.8 CVSS score, allows remote code execution, information disclosure, and denial-of-service attacks due to memory access vulnerabilities. Affected products: SIMATIC HMI Comfort Outdoor Panels v15 7’ and 15’, SIMATIC HMI Comfort Panels v15 4’-22’, SIMATIC HMI KTP Mobile Panels v15 KTP400F, KTP700, KTP700F, KTP900, KTP900F, SIMATIC WinCC Runtime Advanced v15, SIMATIC HMI Comfort Outdoor Panels v16 7’ and 15’, SIMATIC HMI Comfort Panels v16 4’-22’, SIMATIC HMI KTP Mobile Panels v16 KTP400F, KTP700, KTP700F, KTP900, KTP900F, SIMATIC WinCC Runtime Advanced v16

Reporter	Title	Published	Views	Family All 79
ATTACKERKB	CVE-2021-27384	12 May 202114:15	–	attackerkb
ATTACKERKB	CVE-2021-25662	12 May 202114:15	–	attackerkb
ATTACKERKB	CVE-2021-25660	12 May 202114:15	–	attackerkb
ATTACKERKB	CVE-2021-27385	12 May 202114:15	–	attackerkb
ATTACKERKB	CVE-2021-25661	12 May 202114:15	–	attackerkb
ATTACKERKB	CVE-2021-27383	12 May 202114:15	–	attackerkb
ATTACKERKB	CVE-2021-27386	12 May 202114:15	–	attackerkb
BDU FSTEC	The vulnerabilities of Siemens SIMATIC and SINAMICS software products allow a perpetrator to execute arbitrary code.	24 Dec 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogramming software in Siemens SIMATIC and SINAMICS products, related to a memory release error, allows attackers to trigger malfunctions during maintenance operations.	28 Jun 202300:00	–	bdu_fstec
CNNVD	Siemens SIMATIC WinCC 缓冲区错误漏洞	11 May 202100:00	–	cnnvd

Source	Link
cert-portal	www.cert-portal.siemens.com/productcert/csaf/ssa-538778.json
cert-portal	www.cert-portal.siemens.com/productcert/txt/ssa-538778.txt
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-131-12.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-131-12
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/resources-tools/resources/ics-recommended-practices
cisa	www.cisa.gov/topics/industrial-control-systems
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

11 May 2021 00:00Current

8.9High risk

Vulners AI Score8.9

CVSS 27.5

CVSS 3.19.8

EPSS0.02559

SSVC