1. EXECUTIVE SUMMARY

  • CVSS v3 7.5
  • ATTENTION: Exploitable remotely/low skill level to exploit
  • Vendor: Siemens
  • Equipment: IE/PB-Link, RUGGEDCOM, SCALANCE, SIMATIC, SINEMA
  • Vulnerabilities: Uncontrolled Resource Consumption, Improper Input Validation

2. RISK EVALUATION

Successful exploitation of these vulnerabilities could allow remote attackers to affect the availability of the devices under certain conditions.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following Siemens products are affected:

  • IE/PB-Link v3: All versions
  • RUGGEDCOM RM1224: All versions prior to 6.1
  • RUGGEDCOM ROX II: All versions prior to 2.13.3 (only affected by CVE-2018-5391)
  • SCALANCE M-800 family: All versions prior to 6.1
  • SCALANCE S615: All versions prior to 6.1
  • SCALANCE SC-600: All versions prior to 2.0
  • SCALANCE W1700 IEEE 802.11ac: All versions prior to 2.0
  • SCALANCE W700 IEEE 802.11a/b/g/n: All versions prior to 6.4
  • SIMATIC CP 1242-7: All versions prior to 3.2
  • SIMATIC CP 1243-1 (incl. SIPLUS NET variants): All versions prior to 3.2
  • SIMATIC CP 1243-7 LTE EU: All versions prior to 3.2
  • SIMATIC CP 2243-7 LTE US: All versions prior to 3.2
  • SIMATIC CP 1243-8 IRC: All versions prior to 3.2
  • SIMATIC CP 1542SP-1: All versions prior to 2.1
  • SIMATIC CP 1542SP-1 IRC (incl. SIPLUS NET variants): All versions prior to 2.1
  • SIMATIC CP 1543-1 (incl. SIPLUS NET variants): All versions prior to 2.2
  • SIMATIC CP 1543SP-1 (incl. SIPLUS NET variants): All versions prior to 2.1
  • SIMATIC RF185C: All versions
  • SIMATIC RF186C: All versions
  • SIMATIC RF186CI: All versions
  • SIMATIC RF188C: All versions
  • SIMATIC RF188CI: All versions
  • SINEMA Remote Connect Server: All versions newer than 1.1 and prior to 2.0.1

3.2 VULNERABILITY OVERVIEW

3.2.1    UNCONTROLLED RESEOURCE CONSUMPTION (‘RESOURCE EXHAUSTION’) CWE-400

Certain Linux kernel versions can be forced to make resource intensive calls for every incoming packet, which can lead to a denial-of-service condition.

CVE-2018-5390 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.2.2    IMPROPER INPUT VALIDATION CWE-20

Certain Linux kernels are vulnerable to a denial-of-service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial-of-service condition by sending specially crafted IP fragments.

CVE-2018-5391 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Chemical, Energy, Food and Agriculture, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported to CISA that these publicly known vulnerabilities also affect these products.

4. MITIGATIONS

Siemens recommends applying updates, where available:

  • RUGGEDCOM RM 1224: Update to v6.1
  • RUGGEDCOM ROX II: Update to v2.13.3
  • SCALANCE M-800 family: Update to v6.1
  • SCALANCE S615: Update to v6.1
  • SCALANCE SC-600: Update to v2.0 or later version
  • SCALANCE W1700 IEEE 802.11 ac: Update to v2.0
  • SCALANCE W700 IEEE 802.11a/b/g/n: Update to v6.4
  • SIMATIC CP 1242-7 and 1243-1 (incl. SIPLUS NET variants): Update to v3.2
  • SIMATIC CP 1243-7 LTE EU & US: Update to v3.2
  • SIMATIC CP 1243-8 IRC: Update to v3.2
  • SIMATIC CP 1542SP-1 and 1542SP-1 IRC (incl. SIPLUS NET variants): Update to v2.1
  • SIMATIC 1543SP-1 IRC (incl. SIPLUS NET variants): Update to v2.1
  • SIMATIC CP 1543-1 (incl. SIPLUS NET variants): Update to v2.2
  • SIMATIC CP 1543SP-1 (incl. SIPLUS NET variants): Update to v2.1
  • SINEMA Remote Connect Server: Update to v2.1

Siemens has not identified any specific mitigations or workarounds and recommends following their general security recommendations. As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens operational guidelines for Industrial Security and following the recommendations in the product manuals.

For additional information, please refer to Siemens Security Advisory SSA-377115

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities.

Source:

https://www.us-cert.gov/ics/advisories/icsa-20-105-05