February 2020
Title
SSA-180635 (Last Update: 2020-02-10): Denial-of-Service Vulnerabilities in SIMATIC S7-1500 CPU Family
Published
Feb. 10, 2020, 1 a.m.
Summary
Older versions of the S7-1500 CPU are affected by two Denial-of-Service vulnerabilities. Siemens has released updates for the currently supported hardware versions.
Title
SSA-254686 (Last Update: 2020-02-10): Foreshadow / L1 Terminal Fault Vulnerabilities in Industrial Products
Published
Feb. 10, 2020, 1 a.m.
Summary
Security researchers published information on vulnerabilities known as Foreshadow and L1 Terminal Fault (L1TF). These vulnerabilities affect many modern processors from different vendors to a varying degree. Several Siemens Industrial Products contain processors that are affected by the vulnerabilities.
Title
SSA-892715 (Last Update: 2020-02-10): ME, SPS and TXE Vulnerabilities in SIMATIC IPCs
Published
Feb. 10, 2020, 1 a.m.
Summary
Intel has identified vulnerabilities in Intel Management Engine (ME), Intel Server Platform Services (SPS), and Intel Trusted Execution Engine (TXE). As several Siemens Industrial PCs use Intel technology, they are also affected. Siemens has released updates for the affected Industrial PCs.
Title
SSA-987029 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-300 CPU Family
Published
Feb. 10, 2020, 1 a.m.
Summary
A vulnerability could allow attackers to perform a Denial-of-Service attack over the network without prior authentication against S7-300 CPUs under certain conditions. Siemens recommends specific mitigations. Siemens will update this advisory when new information becomes available.
Title
SSA-306710 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-300 CPU Family
Published
Feb. 10, 2020, 1 a.m.
Summary
Siemens has released a firmware update for the S7-300 CPU family which fixes a vulnerability that could allow remote attackers to perform a Denial-of-Service attack.
Title
SSA-818183 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-300 CPU Family
Published
Feb. 10, 2020, 1 a.m.
Summary
Siemens has released a firmware update for the SIMATIC S7-300 CPU family which fixes a vulnerability that could allow remote attackers to perform a Denial-of-Service attack under certain conditions.
Title
SSA-954136 (Last Update: 2020-02-10): User Impersonation Vulnerability in SCALANCE X-200IRT Switch Family
Published
Feb. 10, 2020, 1 a.m.
Summary
The latest firmware update for the SCALANCE X-200IRT switch family fixes a vulnerability which could allow attackers to impersonate legitimate users of the web interface.
Title
SSA-731239 (Last Update: 2020-02-10): Vulnerabilities in SIMATIC S7-300 and S7-400 CPUs
Published
Feb. 10, 2020, 1 a.m.
Summary
Two vulnerabilities have been identified in SIMATIC S7-300 and S7-400 CPU families. One vulnerability could lead to a Denial-of-Service, the other vulnerability could result in credential disclosure. Siemens recommends specific mitigations. Siemens will update this advisory when new information becomes available.
Title
SSA-546832 (Last Update: 2020-02-10): Vulnerabilities in Medium Voltage SINAMICS and SIMOTION Products
Published
Feb. 10, 2020, 1 a.m.
Summary
The latest updates for medium voltage SINAMICS products fix two security vulnerabilities that could allow an attacker to cause a Denial-of-Service condition either via specially crafted PROFINET DCP broadcast packets or by sending specially crafted packets to port 161/udp (SNMP). Precondition for the PROFINET DCP scenario is a direct Layer ...
Title
SSA-850708 (Last Update: 2020-02-10): Authentication Bypass in SCALANCE X-200 Switch Family
Published
Feb. 10, 2020, 1 a.m.
Summary
A potential vulnerability was discovered in the web server’s authentication of SCALANCE X-200 switches that might allow attackers to hijack web sessions over the network without authentication. Siemens addresses the issue with a firmware update.
Title
SSA-141614 (Last Update: 2020-02-10): Denial-of-Service in SIMOCODE pro V EIP
Published
Feb. 10, 2020, 1 a.m.
Summary
SIMOCODE pro V EIP is affected by a vulnerability that could allow remote attackers to conduct a Denial-of-Service (DoS) attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released an update for SIMOCODE pro V EIP and recommends that customers update to the new version.
Title
SSA-100232 (Last Update: 2020-02-10): Denial-of-Service vulnerability in SCALANCE X switches
Published
Feb. 10, 2020, 1 a.m.
Summary
A vulnerability in the affected devices could allow an unauthenticated attacker with network access to an affected device to perform a denial-of-service. Siemens is preparing updates and recommends specific countermeasures until patches are available.
Title
SSA-234763 (Last Update: 2020-02-10): OpenSSL Vulnerabilities in Siemens Industrial Products
Published
Feb. 10, 2020, 1 a.m.
Summary
Vulnerabilities in OpenSSL (see https://www.openssl.org/news/secadv_20140605.txt) affect several Siemens industrial products. Siemens has released updates for all affected products.
Title
SSA-293562 (Last Update: 2020-02-10): Vulnerabilities in Industrial Products
Published
Feb. 10, 2020, 1 a.m.
Summary
Several industrial devices are affected by two vulnerabilities that could allow an attacker to cause a Denial-of-Service condition via PROFINET DCP network packets under certain circumstances. The precondition for this scenario is a direct layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens has released updates ...
Title
SSA-113131 (Last Update: 2020-02-10): Denial-of-Service Vulnerabilities in SIMATIC S7-400 CPUs
Published
Feb. 10, 2020, 1 a.m.
Summary
Two vulnerabilities have been identified in the SIMATIC S7-400 CPU family that could allow an attacker to cause a Denial-of-Service condition. In order to exploit the vulnerability, an attacker must have access to the affected devices on port 102/tcp via Ethernet, PROFIBUS or Multi Point Interfaces (MPI). Siemens provides updates ...
Title
SSA-310688 (Last Update: 2020-02-10): Denial-of-Service Vulnerability in SIMATIC S7-1500 CPU
Published
Feb. 10, 2020, 1 a.m.
Summary
The latest firmware update for the SIMATIC S7-1500 CPU family fixes a vulnerability which could allow an attacker to perform a Denial-of-Service attack under certain conditions. The attacker must have network access to the device to exploit this vulnerability.
Title
SSA-597212 (Last Update: 2020-02-10): Web Vulnerability in SIMATIC S7-1200 CPU Family
Published
Feb. 10, 2020, 1 a.m.
Summary
The latest firmware version V4.1 of the SIMATIC S7-1200 CPU fixes one vulnerability. The vulnerability could allow an attacker to redirect users to untrusted sites under certain conditions.
January 2020
Title
SSA-242353 (Last Update: 2020-01-14): Access Control Vulnerability in SINAMICS PERFECT HARMONY GH180
Published
Jan. 14, 2020, 1 a.m.
Summary
A race condition in the restart behaviour of SINAMICS PERFECT HARMONY GH180 could allow an unauthorized attacker with physical access to the affected device to restart the HMI with disabled security controls, which could be used to launch further attacks against the affected device. Siemens recommends customers to apply a ...
Title
SSA-480230 (Last Update: 2020-01-14): Denial-of-Service in Webserver of Industrial Products
Published
Jan. 14, 2020, 1 a.m.
Summary
A vulnerability in the affected devices could allow an unauthorized attacker with network access to the webserver of an affected device to perform a denial-of-service attack. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and recommends ...
Title
SSA-878278 (Last Update: 2020-01-14): Denial-of-Service Vulnerability in SIMATIC WinAC RTX (F) 2010
Published
Jan. 14, 2020, 1 a.m.
Summary
A vulnerability in SIMATIC WinAC RTX (F) 2010 controller software could allow an attacker to perform a denial-of-service attack if a large HTTP request is sent to the network port of the host where WinAC RTX is running. Siemens has released SIMATIC WinAC RTX (F) 2010 incl. SP3 Update 1 ...
Title
SSA-557804 (Last Update: 2020-01-14): Mirror Port Isolation Vulnerability in SCALANCE X Switches
Published
Jan. 14, 2020, 1 a.m.
Summary
A vulnerability was identified in several SCALANCE X switches that could allow an attacker to feed information into a network via the mirror port with the monitor barrier feature enabled. The monitor barrier implementation in several SCALANCE X switches does allow traffic to be directed back into the mirroring network. ...
Title
SSB-382508 (Last Update: 2020-01-14): ActiveX used in Industrial Products
Published
Jan. 14, 2020, 1 a.m.
Summary
Title
SSA-418979 (Last Update: 2020-01-14): Vulnerabilities in EN100 Ethernet Communication Module
Published
Jan. 14, 2020, 1 a.m.
Summary
The EN100 Ethernet communication modules are affected by security vulnerabilities which could allow an attacker to disclose information. Siemens has released updates for several affected products, is working on updates for the remaining affected products, and recommends specific countermeasures until fixes are available.
Title
SSA-181018 (Last Update: 2020-01-14): Heap Overflow Vulnerability in SCALANCE X switches, RUGGEDCOM Win, RFID 181-EIP, and SIMATIC RF182C
Published
Jan. 14, 2020, 1 a.m.
Summary
SCALANCE X switches, RUGGEDCOM Win, RFID 181-EIP, and SIMATIC RF182C are affected by a vulnerability that could allow an unprivileged attacker located in the same local network segment (OSI Layer 2) to gain system privileges by sending a specially crafted DHCP response to a client's DHCP request. Siemens has released ...
Title
SSA-307392 (Last Update: 2020-01-14): Denial-of-Service in OPC UA in Industrial Products
Published
Jan. 14, 2020, 1 a.m.
Summary
A vulnerability has been identified in the OPC UA server of several industrial products. The vulnerability could cause a Denial-of-Service condition on the service or the device. Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates and ...

Last Updates

BOSCH PSIRT
20.03.2024
CODESYS
28.06.2023
SIEMENS CERT
19.04.2024
US CERT
17.04.2024
US CERT (ICS)
18.04.2024

By Source

Archive

2024
2023
2022
2021
2020
2019
2018
2017

Feeds