1. EXECUTIVE SUMMARY

  • CVSS v3 7.5
  • ATTENTION: Exploitable remotely
  • Vendor: Siemens
  • Equipment: SIMATIC S7-1500 CPU family
  • Vulnerability: Resource exhaustion

2. RISK EVALUATION

This vulnerability could allow a remote attacker to conduct denial-of-service attacks.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of SIMATIC are affected:

  • SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants): All versions
  • SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): All versions v2.5 or higher and lower than v2.8
  • SIMATIC S7-1500 Software Controller: All versions v2.5 or higher and lower than v20.8

3.2 VULNERABILITY OVERVIEW

3.2.1    UNCONTROLLED RESOURCE CONSUMPTION (‘RESOURCE EXHAUSTION’) CWE-400

Affected devices contain a vulnerability that allows an unauthenticated attacker to trigger a denial-of-service condition. The vulnerability can be triggered if specially crafted UDP packets are sent to the device.

CVE-2019-19281 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has released updates for several affected products, is working on updates for the remaining affected products, and recommends specific countermeasures until fixes are available:

  • For SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), Siemens recommends that network access should be restricted to affected devices.
  • For SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), Siemens recommends users update to v2.8
  • For SIMATIC S7-1500 Software Controller, Siemens recommends users update to v20.8 (v2x.8 corresponds to v2.8 of the S7-1500 CPU firmware).

For more information on this vulnerability and associated software updates, please see Siemens security advisory SSA-750824

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should protect themselves from social engineering attacks: 

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

Source:

https://www.us-cert.gov/ics/advisories/icsa-20-042-11