1. EXECUTIVE SUMMARY
- CVSS v3 6.5
- ATTENTION: Exploitable from an adjacent network/low skill level to exploit.
- Vendor: Siemens
- Equipment: Devices using the PROFINET Discovery and Configuration Protocol (DCP)
- Vulnerabilities: Improper Input Validation
2. UPDATE INFORMATION
This updated advisory is a follow-up to the updated advisory titled ICSA-17-129-02 Siemens devices using the PROFINET Discovery and Configuration Protocol (Update R) that was published August 11, 2020, to the ICS webpage on us-cert.gov.
3. RISK EVALUATION
Successful exploitation of these vulnerabilities could cause the targeted device to enter a denial-of-service condition, which may require human interaction to recover the system.
4. TECHNICAL DETAILS
4.1 AFFECTED PRODUCTS
Siemens reports that these vulnerabilities affect the following products using PROFINET DCP:
- SIMATIC CP 343-1 Std, CP 343-1 Lean: All versions prior to v3.1.3
- SIMATIC CP 343-1 Adv: All versions
- SIMATIC CP 443-1 Std, CP 443-1 Adv: All versions prior to v3.2.17
- SIMATIC CP 443-1 OPC-UA: All versions
- SIMATIC CP 1243-1 and CP 1243-1 IRC: All versions prior to v2.1.82
- SIMATIC CP 1243-1 IEC: All versions
- SIMATIC CP 1243-1 DNP3: All versions
- SIMATIC CM 1542-1: All versions prior to v2.0
- SIMATIC CP 1543SP-1, CP 1542SP-1 and CP 1542SP-1 IRC: All versions prior to v1.0.15
- SIMATIC CP 1543-1: All versions prior to v2.1
- SIMATIC RF650R, RF680R, RF685R: All versions prior to v3.0
- SIMATIC CP 1616, CP 1604, DK-16xx PN IO: All versions prior to v2.7
- SCALANCE X-200: All versions prior to v5.2.2
- SCALANCE X-200 IRT: All versions prior to v5.4.0
- SCALANCE X300, X408: All versions prior to v4.1.0
- SCALANCE X414: All versions prior to v3.10.2
- SCALANCE XM400, XR500: All versions prior to v6.1
- SCALANCE W700: All versions prior to v6.1
- SCALANCE M-800, S615: All versions prior to v04.03
- Softnet PROFINET IO for PC-based Windows systems: All versions prior to v14 SP1
- IE/PB-Link: All versions prior to v3.0
- IE/AS-i Link PN IO: All versions
- SIMATIC Teleservice Adapter Standard Modem, IE Basic, IE Advanced: All versions
- SITOP PSU8600 PROFINET: All versions prior to v1.2.0
- SITOP UPS1600 PROFINET: All versions prior to v2.2.0
- SIMATIC ET 200AL: All versions prior to v1.0.2
——— Begin Update S Part 1 of 3 ———
- SIMATIC ET200ecoPN (except 6ES7141-6BG00-0BB0, 6ES7141-6BH00-0BB0, 6ES7142-6BG00-0BB0, 6ES7142-6BR00-0BB0, 6S7143-6BH00-0BB0, 6ES7146-6FF00-0AB0, 6ES7148-6JD00-0AB0 and 6ES7148-6JG00-0BB0): All versions
——— End Update S Part 1 of 3 ———
- SIMATIC ET 200M: All versions
- SIMATIC ET 200MP IM155-5 PN BA: All versions prior to v4.0.1
- SIMATIC ET 200MP IM155-5 PN ST: All versions prior to v4.1
- SIMATIC ET 200MP IM155-5 PN HF: All versions prior to v4.2
- SIRIUS ACT 3SU1 interface module PROFINET: All versions prior to v1.1.0
- SIMATIC ET 200pro: All versions
- SIMATIC ET 200S: All versions
- SIMATIC ET 200SP IM155-6 PN HF: All versions prior to v 4.2.0
- SIMATIC ET 200SP (except IM155-6 PN ST and IM155-6 PN HF): All versions
- SIMATIC PN/PN Coupler: All versions prior to v4.0
- Development/Evaluation Kits DK Standard Ethernet Controller: All versions prior to v4.1.1 Patch04
- Development/Evaluation Kits EK-ERTEC 200P PN IO: All versions prior to v4.4.0 Patch01
- Development/Evaluation Kits EK-ERTEC 200 PN IO: All versions prior to v4.2.1 Patch03
- SIMATIC S7-200 SMART: All versions prior to v2.3
- SIMATIC S7-300 including F and T: All versions prior to v3.X.14
- SIMATIC S7-400 PN/DP v6 Incl. F: All versions prior to v6.0.6
- SIMATIC S7-400-H v6: All versions prior to v6.0.7
- SIMATIC S7-400 PN/DP v7 Incl. F: All versions prior to v7.0.2
- SIMATIC S7-410: All versions prior to v8.2
- SIMATIC S7-1200 including F: All versions prior to v4.2.1
- SIMATIC S7-1500 including F, T, and TF: All versions prior to v2.1
- SIMATIC S7-1500 Software Controller including F: All versions prior to v2.1
- SIMATIC WinAC RTX (F) 2010: All versions prior to SIMATIC WinAC RTX 2010 SP3
- SIRIUS Soft starter 3RW44 PN: All versions
- SIRIUS Motor starter M200D PROFINET: All versions
- SIMOCODE pro V PROFINET: All versions prior to v2.0.0
- SINAMICS DCM w. PN: All versions prior to v1.4 SP1 HF5
- SINAMICS DCP w. PN: All versions prior to v1.2 HF 1
- SINAMICS G110M / G120(C/P/D) w. PN: All versions prior to v4.7 SP6 HF3
- SINAMICS G130 and G150 v4.7 w. PN: All versions prior to v4.7 HF27
- SINAMICS G130 and G150 v4.8 w. PN: All versions prior to v4.8 HF4
- SINAMICS S110 w. PN: All versions prior to v4.4 SP3 HF5
- SINAMICS S120 prior to v4.7 w. PN: All versions prior to v4.7
- SINAMICS S120 v4.7 w. PN: All versions prior to v4.7 H27
- SINAMICS S120 v4.7 SP1 w. PN: All versions prior to v4.7 HF27
- SINAMICS S120 v4.8 w. PN: All versions prior to v4.8 HF4
- SINAMICS S150 v4.7 w. PN: All versions prior to v4.7 HF27
- SINAMICS S150 v4.8 w. PN: All versions prior to v4.8 HF4
- SINAMICS v90 w. PN: All versions prior to v1.01
- SIMOTION: All versions prior to v4.5 HF1
- SINUMERIK 828D v4.5 and prior: All versions prior to v4.5 SP6 HF2
- SINUMERIK 828D v4.7: All versions prior to v4.7 SP4 HF1
- SINUMERIK 840D sl v4.5 and prior: All versions prior to v4.5 SP6 HF2
- SINUMERIK 840D sl v4.7: All versions prior to v4.7 SP4 HF1, and
- SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels: All versions prior to v15.1
- SIMATIC TDC CPU555: All versions prior to v1.1.1
- SIMATIC TDC CP51M1: All versions prior to v1.1.8
——— Begin Update S Part 2 of 3 ———
- SIMATIC MV400 family: All versions prior to v7.0.6
——— End Update S Part 2 of 3 ———
4.2 VULNERABILITY OVERVIEW
4.2.1 IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP broadcast packets could cause a denial-of-service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected.
CVE-2017-2680 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
4.2.2 IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial-of-service condition in that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.
This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices.
CVE-2017-2681 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
4.3 BACKGROUND
- CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater Systems
- COUNTRIES/AREAS DEPLOYED: Worldwide
- COMPANY HEADQUARTERS LOCATION: Germany
4.4 RESEARCHER
Duan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team reported these vulnerabilities directly to Siemens.
5. MITIGATIONS
The attacker must have network access to the local Ethernet segment (Layer 2).
Siemens strongly recommends verifying the affected products are protected as described in the PROFINET Security Guidelines and Siemens Operational Guidelines to run the devices in a protected IT environment.
Siemens provides firmware updates fixing the vulnerabilities for the following affected products and recommends users update to the new fixed version:
- SIMATIC CP 343-1 Std and SIMATIC CP 343-1 Lean: Update to v3.1.3
- SIMATIC CP 443-1 Std: Update to v3.2.17
- SIMATIC CP 443-1 Adv: Update to v3.2.17
- SIMATIC CP 1243-1 and SIMATIC CP 1243-1 IRC: Update to v3.1
- SIMATIC CM 1542-1: Update to v2.0
- SIMATIC CP 1542SP-1, CP 1542SP-1 IRC, and CP 1543SP-1: Update to v1.0.15
- SIMATIC CP 1543-1: Update to v2.1
- SIMATIC RF650R, RF680R, RF685R: Update to v3.0
- SIMATIC CP 1616, CP 1604, DK-16xx PN IO: Update to v2.7
- SCALANCE X-200: Update to v5.2.2
- SCALANCE X-200IRT: Update to vV5.4.0
- SCALANCE X-300/X408: Update to v4.1.0
- SCALANCE X414: Update to v3.10.2
- SCALANCE XM400: Update to v6.1
- SCALANCE XR500: Update to v6.1
- SCALANCE W700: Update to v6.1.0
- SCALANCE M-800, S615: Update to v04.3
- Softnet PROFINET IO for PC-based Windows systems: Update to v14 SP1
- IE/PB-Link: Update to v3.0
- SITOP PSU8600 PROFINET: Update to v1.2.0
- SITOP UPS1600 PROFINET: Update to v2.2.0
- SIMATIC ET 200AL: Update to v1.0.2
- SIMATIC ET 200SP: Update to v4.1.0
- SIMATIC ET 200MP IM155-5 PN BA: Update to v4.0.1 or newer
- SIMATIC ET 200MP IM155-5 PN ST: Update to v4.1
- SIMATIC ET 200MP IM155-5 PN HF: Update to v4.2
- SIRIUS ACT 3SU1 interface module PROFINET: Update to v1.1.0
- SIMATIC ET 200SP IM155-6 PN ST: Update to v4.1.0
- SIMATIC ET 200SP IM155-6 PN HF: Update to v4.2.0
- SIMATIC PN/PN Coupler: Update to v4.0
- Development/Evaluation Kits DK Standard Ethernet Controller: Update to v4.1.1 Patch04
- Development/Evaluation Kits EK-ERTEC 200P PN IO: Update to v4.4.0 Patch01
- Development/Evaluation Kits EK-ERTEC 200 PN IO: Update to v4.2.1 Patch03
Updates for Development/Evaluation Kits for PROFINET IO can be obtained via ComDeC
at comdec@siemens.com or pic.industry@siemens.com - SIMATIC S7-200 SMART: Contact the local Siemens representative or customer support to update to v2.3
- SIMATIC S7-300 including F and T: Update to v3.X.14 (en) or Update to v3.X.14 (de)
- SIMATIC S7-400 PN/DP V6 Incl. F: Update to vV6.0.6
- SIMATIC S7-400 PN/DP V7 Incl. F: Update to v7.0.2
- SIMATIC S7-400-H V6: Update to v6.0.7
- SIMATIC S7-CPU 410: Update to v8.2
- SIMATIC S7-1200 including F: Update to v4.2.1
- SIMATIC S7-1500 including F, T and TF: Update to v2.1
- SIMATIC S7-1500 Software Controller including F: Update to v2.1
- SIMATIC WinAC RTX (F) 2010: Update to SIMATIC WinAC RTX 2010 SP3 and apply BIOS and Microsoft Windows updates
- SINAMICS DCM w. PN: Update to v1.4 SP1 HF5
- SINAMICS DCP w. PN: Update to v1.2 HF1
- SINAMICS G110M/G120(C/P/D) w. PN: Update to v4.7 SP6 HF3
- SINAMICS G130 and G150 V4.7: Update to v4.7 HF27
- SINAMICS G130 and G150 V4.8: Update to v4.8 HF4
- SINAMICS S110 w. PN: Update to v4.4 SP3 HF5
- SINAMICS S120 V4.7: Update to v4.7 HF27
- SINAMICS S120 V4.8: Update to v4.8 HF4
- SINAMICS S150 V4.7: Update to v4.7 HF27
- SINAMICS S150: V4.8: Update to v4.8 HF4
- SINAMICS V90 w. PN: Update to v1.1
- SIMOCODE pro V PROFINET: Update to v2.0.0
- SIMOTION: Update to v4.5 HF1
- SINUMERIK 828D v4.5: Update to v4.5 SP6 HF2
- SINUMERIK 828D v4.7: Update to v4.7 SP4 HF1
- SINUMERIK 840D sl v4.5 and prior: Update to v4.5 SP6 HF8
- SINUMERIK 840D sl v4.7: Update to v4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager. - SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels: Update to v15.1
- SIMATIC TDC CPU555: Update to v1.1.1
- SIMATIC TDC CP51M1: Update to v1.1.8
- SIMATIC Teleservice Adapters (IE Basic, IE Standard, IE Advanced): migrate to a successor product within the SCALANCE M-800 family. For details refer to the notice of discontinuation.
——— Begin Update S Part 3 of 3 ———
- SIMATIC MV400 family: Update to v7.0.6
——— End Update S Part 3 of 3 ———
Siemens is preparing updates for the remaining affected products and recommends the following mitigations in the meantime:
- Apply cell protection concept.
- Use VPN for protecting network communication between cells.
- Apply Defense-in-Depth.
As a general security measure Siemens and PNO strongly recommend protecting industrial control systems networks with appropriate mechanisms. Siemens encourages users to verify that the affected products are protected as described in PNO Security Guidelines and Siemens operational guidelines to run the devices in a protected IT environment.
For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens security advisory SSA-293562
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
Source: