SSA-838121: Multiple Denial of Service Vulnerabilities in ...

1 Siemens Security Advisory by Siemens ProductCERTSSA-838121:MultipleDenialofSe rviceVulnerabilitiesinIndustrialProducts Publication Date:2022-02-08 Last Update:2022-07-12 Current Base Score: SIMATIC firmware contains three Vulnerabilities that could allow an unauthenticated attacker toperform a Denial -of- Service attack under certain has released updates for several affected products and recommends to update to the latestversions. Siemens is preparing further updates and recommends countermeasures for products whereupdates are not, or not yet Product and VersionsRemediationSIMATIC Drive Controller family:All versions < affected by CVE-2021-37204 Update to or later Drive Controller family:All versions >= < to or later ET 200SP Open Controller CPU1515SP PC2 (incl. SIPLUS variants):All versions < affected by CVE-2021-37204 Update to or later ET 200SP Open Controller CPU1515SP PC2 (incl. SIPLUS variants):All versions >= < to or later ET 200SP Open Controller CPU1515SP PC2 Ready4 Linux:All versionsonly affected by CVE-2021-37204 Currently no fix is plannedSIMATIC ET 200SP Open Controller CPU1515SP PC (incl.)

2 SIPLUS variants):All versionsonly affected by CVE-2021-37204 Currently no fix is plannedSIMATIC S7-1200 CPU family (incl. SIPLUS vari-ants):All versions < affected by CVE-2021-37204 Update to or later Siemens 2022 Page 1 of 4 Siemens Security Advisory by Siemens ProductCERTSIMATIC S7-1200 CPU family (incl. SIPLUS vari-ants):All versions >= < to or later S7- 1500 CPU family ( CPUs and SIPLUS variants):All versions < affected by CVE-2021-37204 Update to or later S7- 1500 CPU family ( CPUs and SIPLUS variants):All versions >= < to or later S7- 1500 Software Controller:All versions < affected by CVE-2021-37204 Update to or later S7- 1500 Software Controller:All versions >= < to or later S7-PLCSIM Advanced:All versions < affected by CVE-2021-37204 Update to SP1 or later S7-PLCSIM Advanced:All versions >= < SP1 Update to SP1 or later 1531 IRC (incl. SIPLUS NET variants):All versions >= no fix is availableWORKAROUNDSANDMITIGATIONSP roduct specific remediations or mitigations can be found in the section Affected Products and follow the General Security a general security measure, Siemens strongly recommends to protect network access to deviceswith appropriate mechanisms.

3 In order to operate the devices in a protected IT environment, Siemensrecommends to configure the environment according to Siemens operational guidelines for IndustrialSecurity (Download: ), and tofollow the recommendations in the product information on Industrial Security by Siemens can be found at: Siemens 2022 Page 2 of 4 Siemens Security Advisory by Siemens ProductCERTPRODUCTDESCRIPTIONP roducts of the SIMATIC Drive Controller family have been designed for the automation of productionmachines, combining the functionality of a SIMATIC S7- 1500 CPU and a SINAMICS S120 drive ET 200SP Open Controller is a PC-based version of the SIMATIC S7- 1500 Controller includingoptional visualization in combination with central I/Os in a compact S7-1200 CPU products have been designed for discrete and continuous control in industrialenvironments such as manufacturing, food and beverages, and chemical industries S7- 1500 CPU products have been designed for discrete and continuous control in industrialenvironments such as manufacturing, food and beverages, and chemical industries S7- 1500 Software Controller is a SIMATIC software controller for PC-based automation S7-PLCSIM Advanced simulates S7-1200, S7- 1500 and a few other PLC derivatives.

4 Includesfull network access to simulate the PLCs, even in virtualized extreme products are designed for reliable operation under extreme conditions and are based onSIMATIC, LOGO!, SITOP, SINAMICS, SIMOTION, SCALANCE or other devices. SIPLUS devices use thesame firmware as the product they are based 1531 IRC is a communication module for SIMATIC S7- 1500 , S7-400, S7-300 with SINAUT ST7,DNP3 and IEC 60870-5-101/104 with three RJ45 interfaces for communication via IP-based networks(WAN / LAN) and a RS 232/RS 485 interface for communication via classic WAN vulnerability classification has been performed by using the CVSS scoring system in version (CVSS ) ( ). The CVSS environmental score is specific to the customer senvironment and will impact the overall CVSS score. The environmental score should therefore beindividually defined by the customer to accomplish final additional classification has been performed using the CWE classification, a community-developed listof common software security weaknesses.

5 This serves as a common language and as a baseline forweakness identification, mitigation, and prevention efforts. A detailed list of CWE classes can be found at: unauthenticated attacker could cause a Denial -of- Service condition in a PLC when sending speciallyprepared packets over port 102/tcp. A restart of the affected device is needed to restore Base :N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL :O/RC:CCWECWE-672: Operation on a Resource after Expiration or ReleaseVulnerabilityCVE-2021-37204An unauthenticated attacker could cause a Denial -of- Service condition in a PLC when sending speciallyprepared packet over port 102/tcp. A restart of the affected device is needed to restore Base :N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL :O/RC:CCWECWE-672: Operation on a Resource after Expiration or ReleaseSSA-838121 Siemens 2022 Page 3 of 4 Siemens Security Advisory by Siemens ProductCERTV ulnerabilityCVE-2021-37205An unauthenticated attacker could cause a Denial -of- Service condition in a PLC when sending speciallyprepared packets over port 102/tcp.

6 A restart of the affected device is needed to restore Base :N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL :O/RC:CCWECWE-401: Missing Release of Memory after Effective LifetimeACKNOWLEDGMENTSS iemens thanks the following parties for their efforts: Gao Jian for coordinated disclosureADDITIONALINFORMATIONFor further inquiries on security Vulnerabilities in Siemens products and solutions, please contact theSiemens ProductCERT: (2022-02-08):Publication (2022-03-08):Added solution for SIMATIC S7-PLCSIM (2022-07-12):Added fix for SIMATIC ET 200SP Open Controller CPU 1515SP PC2 and SIMATICS7- 1500 Software Controller, clarify that CVE-2021-37204 is also affecting deviceswithout TLS and added SIMATIC ET 200SP Open Controller CPU 1515SP PC(incl. SIPLUS variants) and SIMATIC ET 200SP Open Controller CPU 1515 SPPC2 Ready4 Linux as affected by CVE-2021-37204 TERMSOFUSES iemens Security Advisories are subject to the terms and conditions contained in Siemens underlyinglicense terms or other applicable agreements previously agreed to with Siemens (hereinafter "LicenseTerms").

7 To the extent applicable to information, software or documentation made available in or througha Siemens Security Advisory, the Terms of Use of Siemens Global Website ( , hereinafter "Terms of Use"), in particular Sections 8-10 of the Terms of Use, shall applyadditionally. In case of conflicts, the License Terms shall prevail over the Terms of Siemens 2022 Page 4 of 4