Latest Vulnerabilities: Multiple vulnerabilities in various Siemens product lines #
Siemens has disclosed 35 vulnerabilities in a variety of Siemens products, including their LOGO!, SIMATIC, SINEMA, and other product lines. These vulnerabilities have CVSS scores that range from 4.3 (moderate) to 10 (extremely critical).
The most critical vulnerabilities disclosed include:
- SSA-955858 - multiple vulnerabilities in LOGO! 8 BM devices (CVSS score 9.8)
- SSA-832273 - multiple vulnerabilities in RUGGEDOM devices (CVSS score 9.8)
- SSA-721642 - multiple vulnerabilities in SCALANCE devices (CVSS score 9.1)
- SSA-673996 - multiple vulnerabilities in SICAM and SITIPE devices (CVSS score 8.2)
- SSA-629254 - remote code execution vulnerability in SIMATIC SCADA and PCS 7 systems (CVSS score 9.1)
- SSA-455250 - multiple vulnerabilities in RUGGEDCOM devices (CVSS score 9.8)
- SSA-039007 - heap-based buffer overflow in the Siemens User Management Console component (CVSS score 9.8)
What is the impact? #
The disclosed vulnerabilities range in severity. For the most critical vulnerabilities, unauthenticated remote attackers could execute arbitrary code and completely take over a vulnerable system. Successful exploitation of other disclosed vulnerabilities could result in denial-of-service conditions or disclosure of sensitive information.
Are updates or workarounds available? #
For most of the disclosed vulnerabilities, Siemens has released updates or patches. However, some vulnerabilities mentioned above, including some critical vulnerabilities, do not have patches released and it is unclear when such updates would be available. Siemens recommends that all systems be kept behind firewalls and have unnecessary services disabled.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
vendor:SiemensSCALANCE and RUGGEDCOM products (August 2024) #
Siemens has disclosed multiple vulnerabilities for a variety of products and devices, including the SCALANCE and RUGGEDCOM product lines.
- CVE-2024-41976 is rated high, with a CVSS score of 7.2, and allows an attacker to issue invalid VPN configuration data causing an authenticated attacker to execute arbitrary code.
- CVE-2024-41977 is rated high, with a CVSS score of 7.1, and allows an attacker to escalate their privileges due to devices not properly enforcing user session isolation.
- CVE-2024-41978 is rated high, with a CVSS score of 6.5, and allows an authenticated attacker to forge 2FA tokens of other users due to devices storing sensitive 2FA information in log files on disk.
- CVE-2024-44321 is rated medium, with a CVSS score of 2.7, and allows an attacker to issue large input data causing an unauthenticated denial-of-service.
What is the impact? #
Successful exploitation of this vulnerability would allow an authenticated attacker to remotely execute code, escalate their privileges, or forge other users credentials. The first three do require attacks be authenticated initially to exploit these vulnerabilities.
The last vulnerability is on the lower score, but would still require the device be restarted if the denial-of-service condition was triggered.
Are updates or workarounds available? #
Siemens recommends upgrading all affected devices to firmware V8.1 or later. Additionally, users should ensure these devices are isolated in their own networks to prevent unwanted network traffic to the device.
How to find potentially vulnerable systems with runZero #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
hw:"RUGGEDCOM" OR hw:"SCALANCE" OR hw:"LOGO"CVE-2024-35292 - SIMATIC S7-200 SMART Devices (July 2024) #
In July 2024, Siemens disclosed a vulnerability in their SIMATIC S7-200 SMART Devices.
CVE-2024-35292 is rated high, with a CVSS score of 8.2, and allowed attackers to predict IP ID sequence numbers as their base method of attack and eventually could allow an attacker to create a denial-of-service condition.
What was the impact? #
Successful exploitation of this vulnerability would allow an attacker to issue a denial-of-service condition.
Are updates or workarounds available? #
The only workaround was to restrict access to the network where the affected products were located by introducing strict access control mechanisms.
How runZero users found potentially vulnerable systems #
From the Asset Inventory, runZero users applied the following query to locate systems running potentially vulnerable software:
hw:SIMATICSENTRON, SCALANCE, and RUGGEDCOM vulnerabilities (March 2024) #
In March, 2024, Siemens released security advisories for a variety of products and devices, including the SENTRON, SCALANCE, and RUGGEDCOM product lines.
Several of the vulnerabilities had CVSS scores in the 7.0 to 8.9 range (high) and several more in the 9.0 to 10.0 range (critical).
For the full list of vulnerabilities, you can consult Siemens ProductCERT.
What was the impact? #
Several of these vulnerabilities allowed for unauthenticated remote code execution, allowing for compromise of the vulnerable systems. Other vulnerabilities could lead to privilege escalation, information disclosure, or denial of service. Users were urged to upgrade as quickly as possible.
Siemens released updates via a variety of channels. See Siemens ProductCERT for details.
How runZero users found potentially vulnerable systems #
From the Asset Inventory, runZero users applied the following query to locate Siemens assets that were potentially vulnerable:
hardware:Siemens OR hardware:RuggedCom
