ICSA-17-306-01 Siemens SIMATIC PCS 7 (Update A)

1. EXECUTIVE SUMMARY CVSS v3 4.9 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: SIMATIC PCS 7 Vulnerabilities: Improper Input Validation 2. UPDATE INFORMATION This updated advisory is a follow-up to the original advisory titled ICSA-17-306-01 Siemens SIMATIC...

The vulnerability of the microprogramming software of Siemens SIMATIC STEP 7 (TIA Portal) arises from the incorrect file management format used for TIA project files during version updates. This allows attackers to access important information regarding configuration settings.

The vulnerability of the microprogramming software used in Siemens SIMATIC STEP 7 TIA Portal is related to the use of an incorrect file management format for TIA project files during version updates. Exploiting this vulnerability can allow a local attacker to access important configuration...

Siemens SIMATIC WinCC (TIA Portal) < 14 SP1 XXE Vulnerability

Binary data scadasiemenstiawinccSSA-535640.nbin...

CVE-2017-12069

An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server LDS before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 All versions V8.1 and earlier, SIMATIC WinCC All versions V7.4 SP1, SIMATIC WinCC Runtime...

Design/Logic Flaw

An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server LDS before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 All versions V8.1 and earlier, SIMATIC WinCC All versions V7.4 SP1, SIMATIC WinCC Runtime...

CVE-2017-12069

An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server LDS before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 All versions V8.1 and earlier, SIMATIC WinCC All versions V7.4 SP1, SIMATIC WinCC Runtime...

CVE-2017-12069

Summary: CVE-2017-12069 is an XXE vulnerability in the OPC UA Discovery Server handling of XML, affecting Siemens products using the OPC UA Stack (e.g., SIMATIC PCS 7, SIMATIC WinCC, SIMATIC WinCC Runtime Professional, SIMATIC NET PC Software, and IT Production Suite). Root cause: Improper restri...

CVE-2017-12069

An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server LDS before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 All versions V8.1 and earlier, SIMATIC WinCC All versions V7.4 SP1, SIMATIC WinCC Runtime...

Siemens Fixes Session Hijacking Bug in LOGO!, Warns of Man-in-the-Middle Attacks

Administrators who have Siemens’ LOGO! logic module deployed in automation setups are being urged to update its firmware. The German industrial manufacturing giant pushed out an update for its LOGO! 8 BM devices Wednesday morning to fix a vulnerability CVE-2017-12734 that could let an attacker...

CVE-2017-12069: Improper Restriction of XML External Entity Reference

An XXE vulnerability has been identified in OPC Foundation UA .NET Sample Code before 2017-03-21 and Local Discovery Server LDS before 1.03.367. Among the affected products are Siemens SIMATIC PCS7 All versions V8.1 and earlier, SIMATIC WinCC All versions V7.4 SP1, SIMATIC WinCC Runtime...

Siemens SIMATIC S7 PLC Multiple Vulnerabilities (SSA-293562)

Siemens SIMATIC S7 devices are prone to multiple vulnerabilities. Copyright C 2017 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

CVE-2017-9938

A vulnerability was discovered in Siemens SIMATIC Logon All versions before V1.6 that could allow specially crafted packets sent to the SIMATIC Logon Remote Access service on port 16389/tcp to cause a Denial-of-Service condition. The service restarts automatically...

Design/Logic Flaw

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android All versions before V1.0.2.2 and SIMATIC WinCC Sm@rtClient for Android Lite All versions before V1.0.2.2. An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass...

Denial of service

A vulnerability was discovered in Siemens SIMATIC Logon All versions before V1.6 that could allow specially crafted packets sent to the SIMATIC Logon Remote Access service on port 16389/tcp to cause a Denial-of-Service condition. The service restarts automatically...

CVE-2017-6871

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android All versions before V1.0.2.2 and SIMATIC WinCC Sm@rtClient for Android Lite All versions before V1.0.2.2. An attacker with physical access to an unlocked mobile device, that has the affected app running, could bypass...

CVE-2017-9938

A vulnerability was discovered in Siemens SIMATIC Logon All versions before V1.6 that could allow specially crafted packets sent to the SIMATIC Logon Remote Access service on port 16389/tcp to cause a Denial-of-Service condition. The service restarts automatically...

Design/Logic Flaw

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android All versions before V1.0.2.2. The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle MitM attack...

CVE-2017-6870

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android All versions before V1.0.2.2. The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle MitM attack...

CVE-2017-9938

Siemens SIMATIC Logon (pre-1.6) is vulnerable to an Out-of-Bounds Write (CWE-787) via specially crafted packets to the Remote Access service on TCP 16389, causing a Denial-of-Service (the service restarts automatically). Affected: SIMATIC Logon, all versions prior to V1.6. Impact: DoS with availa...

CVE-2017-6870

A vulnerability was discovered in Siemens SIMATIC WinCC Sm@rtClient for Android All versions before V1.0.2.2. The existing TLS protocol implementation could allow an attacker to read and modify data within a TLS session while performing a Man-in-the-Middle MitM attack...