Bulletins | CERT@VDE

SSA-838121 V1.1 (Last Update: 2022-03-08): Multiple Denial of Service Vulnerabilities in Industrial Products

Titel

SSA-838121 V1.1 (Last Update: 2022-03-08): Multiple Denial of Service Vulnerabilities in Industrial Products

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf

Text

Affected SIMATIC firmware contains three vulnerabilities that could allow an unauthenticated attacker to perform a denial-of-service attack under certain conditions. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

SSA-703715 V1.1 (Last Update: 2022-03-08): Information Disclosure Vulnerability in Climatix POL909 (AWM and AWB)

Titel

SSA-703715 V1.1 (Last Update: 2022-03-08): Information Disclosure Vulnerability in Climatix POL909 (AWM and AWB)

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-703715.pdf

Text

Climatix POL909 (AWM and AWB) contains an information disclosure vulnerability that could allow a man-in-the-middle attacker to read sensitive data, such as administrator credentials, or modify data in transit. Siemens has released an update for Climatix POL909 (AWM and AWB) and recommends to update to the latest version.

SSA-134279 V1.0: Vulnerability in Mendix Forgot Password Appstore module

Titel

SSA-134279 V1.0: Vulnerability in Mendix Forgot Password Appstore module

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-134279.pdf

Text

Mendix Forgot Password Appstore module contains two vulnerabilities that could allow unauthorized users to take over accounts. Mendix has released an update for the Mendix Forgot Password Appstore module and recommends to update to the latest version.

SSA-250085 V1.0: Multiple Vulnerabilities in SINEC NMS

Titel

SSA-250085 V1.0: Multiple Vulnerabilities in SINEC NMS

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-250085.pdf

Text

SINEC NMS contains multiple vulnerabilities that could allow an attacker to execute arbitrary code on the system, arbitrary commands on the local database or achieve privilege escalation. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

SSA-223353 V1.0: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400

Titel

SSA-223353 V1.0: Multiple Vulnerabilities in Nucleus RTOS based SIMOTICS CONNECT 400

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-223353.pdf

Text

Multiple vulnerabilities (also known as “NUCLEUS:13”) have been identified in the Nucleus RTOS (real-time operating system), originally reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf. SIMOTICS CONNECT 400 devices are affected by some of the vulnerabilities as documented below. Siemens has released an update for the SIMOTICS CONNECT 400 and ...

SSA-166747 V1.0: Scene File Parsing Vulnerability in Simcenter STAR-CCM+ Viewer before V2022.1

Titel

SSA-166747 V1.0: Scene File Parsing Vulnerability in Simcenter STAR-CCM+ Viewer before V2022.1

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-166747.pdf

Text

Siemens Simcenter STAR-CCM+ Viewer is affected by a memory corruption vulnerability that could be triggered when the application reads scene (.sce) files. If a user is tricked to open a malicious file with the affected application, this could lead to a crash, and potentially also to arbitrary code execution or ...

SSA-155599 V1.0: File Parsing Vulnerabilities in COMOS

Titel

SSA-155599 V1.0: File Parsing Vulnerabilities in COMOS

Veröffentlicht

8. März 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-155599.pdf

Text

COMOS uses Drawings SDK from Open Design Alliance that is affected by multiple vulnerabilities that could be triggered when the application reads files in DGN, DXF or DWG file formats. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability ...

Februar 2022

22.02.2022

SSA-306654 V1.0: Insyde BIOS Vulnerabilities in Siemens Industrial Products

Titel

SSA-306654 V1.0: Insyde BIOS Vulnerabilities in Siemens Industrial Products

Veröffentlicht

22. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-306654.pdf

Text

Insyde has published information on vulnerabilities in Insyde BIOS in February 2022. This advisory lists the Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products where updates are not, or not yet available.

SSA-455843 V1.7 (Last Update: 2022-02-17): WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products

Titel

SSA-455843 V1.7 (Last Update: 2022-02-17): WIBU Systems CodeMeter Runtime Vulnerabilities in Siemens Products

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-455843.pdf

Text

CISA and WIBU Systems disclosed six vulnerabilities in different versions of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens products for license management. The vulnerabilities are described in the section “Vulnerability Classification” below and got assigned the CVE IDs CVE-2020-14509, CVE-2020-14513, CVE-2020-14515, CVE-2020-14517, CVE-2020-14519, and ...

SSA-949188 V1.0: File Parsing Vulnerabilities in Simcenter Femap before V2022.1.1

Titel

SSA-949188 V1.0: File Parsing Vulnerabilities in Simcenter Femap before V2022.1.1

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-949188.pdf

Text

Siemens Simcenter Femap versions before V2022.1.1 are affected by vulnerabilities that could be triggered when the application reads files in .NEU or .BDF format. If a user is tricked to open a malicious file with the affected application, an attacker could leverage the vulnerability to leak information or potentially perform ...

SSA-772220 V1.7 (Last Update: 2022-02-17): OpenSSL Vulnerabilities in Industrial Products

Titel

SSA-772220 V1.7 (Last Update: 2022-02-17): OpenSSL Vulnerabilities in Industrial Products

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-772220.pdf

Text

OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1k, that allows an unauthenticated attacker to cause a Denial-of-Service (DoS) if a maliciously crafted renegotiation message is sent. Siemens has released updates for several affected products and recommends to update to the latest versions. ...

SSA-244969 V1.1 (Last Update: 2022-02-17): OpenSSL Vulnerability in Industrial Products

Titel

SSA-244969 V1.1 (Last Update: 2022-02-17): OpenSSL Vulnerability in Industrial Products

Veröffentlicht

17. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-244969.pdf

Text

OpenSSL has published a security advisory [0] about a vulnerability in OpenSSL versions 1.1.1 < 1.1.1l and 1.0.2 < 1.0.2za that allows an attacker to cause a denial of service (DoS) or to disclose private memory content. Siemens has released updates for several affected products and recommends to update to ...

SSA-541018 V1.4 (Last Update: 2022-02-08): Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Par...

Titel

SSA-541018 V1.4 (Last Update: 2022-02-08): Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Part 2)

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf

Text

Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as “AMNESIA:33” vulnerabilities. This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-2020-17437) to Siemens products. Siemens has released updates for several affected products and recommends to update to the latest ...

SSA-349422 V1.7 (Last Update: 2022-02-08): Denial-of-Service in Industrial Real-Time (IRT) Devices

Titel

SSA-349422 V1.7 (Last Update: 2022-02-08): Denial-of-Service in Industrial Real-Time (IRT) Devices

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-349422.pdf

Text

A vulnerability in the affected products could allow an unauthorized attacker with network access to perform a denial-of-service attack resulting in loss of real-time synchronization. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures ...

SSA-346262 V3.2 (Last Update: 2022-02-08): Denial-of-Service in Industrial Products

Titel

SSA-346262 V3.2 (Last Update: 2022-02-08): Denial-of-Service in Industrial Products

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-346262.pdf

Text

Several industrial products are affected by a vulnerability that could allow remote attackers to conduct a Denial-of-Service (DoS) attack by sending specially crafted packets to port 161/udp (SNMP). Siemens has released updates for several affected products, and recommends that customers update to the new version. Siemens is preparing further updates ...

SSA-316383 V1.1 (Last Update: 2022-02-08): NumberJack Vulnerability in LOGO! CMR and SIMATIC RTU 3000 devices

Titel

SSA-316383 V1.1 (Last Update: 2022-02-08): NumberJack Vulnerability in LOGO! CMR and SIMATIC RTU 3000 devices

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-316383.pdf

Text

A vulnerability has been identified in the underlying TCP/IP stack of LOGO! CMR and SIMATIC RTU 3000 devices. It could allow an attacker with network access to the LAN interface of an affected device to hijack an ongoing connection or spoof a new one. The WAN interface, however, is not ...

SSA-309571 V1.1 (Last Update: 2022-02-08): IPU 2021.1 Vulnerabilities in Siemens Industrial Products using Intel CPUs (June 2021)

Titel

SSA-309571 V1.1 (Last Update: 2022-02-08): IPU 2021.1 Vulnerabilities in Siemens Industrial Products using Intel CPUs (June 2021)

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-309571.pdf

Text

Intel has published information on vulnerabilities in Intel products in June 2021. This advisory lists the related Siemens Industrial products affected by these vulnerabilities that can be patched by applying the corresponding BIOS update. In this advisory we summarize: “2021.1 IPU – Intel® CSME, SPS and LMS Advisory” Intel-SA-00459, “2021.1 ...

SSA-307392 V1.7 (Last Update: 2022-02-08): Denial of Service in OPC UA in Industrial Products

Titel

SSA-307392 V1.7 (Last Update: 2022-02-08): Denial of Service in OPC UA in Industrial Products

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-307392.pdf

Text

A vulnerability has been identified in the OPC UA server of several industrial products. The vulnerability could cause a denial of service condition on the service or the device. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates ...

SSA-293562 V3.4 (Last Update: 2022-02-08): Denial of Service Vulnerabilities in PROFINET DCP Implementation of Industrial Products

Titel

SSA-293562 V3.4 (Last Update: 2022-02-08): Denial of Service Vulnerabilities in PROFINET DCP Implementation of Industrial Products

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-293562.pdf

Text

Several industrial devices are affected by two vulnerabilities that could allow an attacker to cause a denial of service condition via PROFINET DCP network packets under certain circumstances. The precondition for this scenario is a direct layer 2 access to the affected products. PROFIBUS interfaces are not affected. Siemens has ...

SSA-211752 V1.1 (Last Update: 2022-02-08): Multiple NTP-Client Related Vulnerabilities in SIMATIC CP 443-1 OPC UA

Titel

SSA-211752 V1.1 (Last Update: 2022-02-08): Multiple NTP-Client Related Vulnerabilities in SIMATIC CP 443-1 OPC UA

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-211752.pdf

Text

All versions of the SIMATIC CP 443-1 OPC UA contain multiple vulnerabilities in the underlying third party component NTP. Siemens recommends specific countermeasures for products where updates are not, or not yet available.

SSA-102233 V1.7 (Last Update: 2022-02-08): SegmentSmack in VxWorks-based Industrial Devices

Titel

SSA-102233 V1.7 (Last Update: 2022-02-08): SegmentSmack in VxWorks-based Industrial Devices

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-102233.pdf

Text

The products listed below contain a vulnerability that could allow remote attackers to affect the availability of the devices under certain conditions. The underlying TCP stack can be forced to make very computation expensive calls for every incoming packet which can lead to a Denial-of-Service. Siemens has released an update ...

SSA-100232 V1.4 (Last Update: 2022-02-08): Denial-of-Service vulnerability in SCALANCE X Switches

Titel

SSA-100232 V1.4 (Last Update: 2022-02-08): Denial-of-Service vulnerability in SCALANCE X Switches

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-100232.pdf

Text

A vulnerability in several SCALANCE X devices could allow an unauthenticated attacker with network access to an affected device to perform a denial-of-service. Siemens has released an update for SCALANCE X-200IRT and recommends to update to the latest version. Siemens recommends specific countermeasures for products where updates are not, or ...

SSA-914168 V1.0: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products

Titel

SSA-914168 V1.0: Multiple Vulnerabilities in SIMATIC WinCC Affecting Other SIMATIC Software Products

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf

Text

Multiple vulnerabilities were found in SIMATIC WinCC that ultimately could allow attackers to retrieve and brute force password hashes and access other systems. Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens is preparing further updates and recommends specific countermeasures for products ...

SSA-838121 V1.0: Multiple Denial of Service Vulnerabilities in Industrial Products

Titel

SSA-838121 V1.0: Multiple Denial of Service Vulnerabilities in Industrial Products

Veröffentlicht

8. Februar 2022 01:00

URL

https://cert-portal.siemens.com/productcert/pdf/ssa-838121.pdf

Text