SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-581267585] Siemens devices using the PROFINET Discovery and Configuration Protocol

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2017-05-09OtherSiemensDuan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team reported these vulnerabilities directly to Siemens. N/ACVE-2017-2680 CVE-2017-2681 N/AN/AN/A

Source

						
							
								
#
# Siemens devices using the PROFINET Discovery and Configuration Protocol
#


### VULNERABLE VENDOR
Siemens


### VULNERABLE PRODUCT
Devices using the PROFINET Discovery and Configuration Protocol (DCP)



### RESEARCHER
Duan JinTong, Ma ShaoShuai, and Cheng Lei from NSFOCUS Security Team reported these vulnerabilities directly to Siemens.



### AFFECTED PRODUCTS

Siemens reports that these vulnerabilities affect the following products using PROFINET DCP:

SIMATIC CP 343-1 Std, CP 343-1 Lean: All versions,
SIMATIC CP 343-1 Adv: All versions,
SIMATIC CP 443-1 Std, CP 443-1 Adv: All versions prior to V3.2.17,
SIMATIC CP 443-1 OPC-UA: All versions,
SIMATIC CP 1243-1: All versions,
SIMATIC CM 1542-1: All versions prior to V2.0,
SIMATIC CP 1543SP-1, CP 1542SP-1 and CP 1542SP-1 IRC: All versions,
SIMATIC CP 1543-1: All versions prior to V2.1,
SIMATIC RF650R, RF680R, RF685R: All versions prior to V3.0,
SIMATIC CP 1616, CP 1604, DK-16xx PN IO: All versions prior to V2.7,
SCALANCE X200: All versions,
SCALANCE X200 IRT: All versions,
SCALANCE X300, X408, X414: All versions,
SCALANCE XM400, XR500: All versions,
SCALANCE W700: All versions prior to V6.1,
SCALANCE M-800,S615: All versions,
Softnet PROFINET IO for PC-based Windows systems: All versions,
IE/PB-Link: All versions prior to V3.0,
IE/AS-i Link PN IO: All versions,
SIMATIC Teleservice Adapter Standard Modem, IE Basic, IE Advanced: All versions,
SITOP PSU8600 / UPS1600 PROFINET: All versions,
SIMATIC ET 200 Interface modules for PROFINET IO:

SIMATIC ET 200AL: All versions,
SIMATIC ET 200ecoPN: All versions,
SIMATIC ET 200M: All versions,
SIMATIC ET 200MP: All versions prior to V4.0.1,
SIMATIC ET 200pro: All versions,
SIMATIC ET 200S: All versions,
SIMATIC ET 200SP: All versions,
PN/PN Coupler: All versions,
Development/Evaluation Kits for PROFINET IO:

DK Standard Ethernet Controller: All versions prior to V4.1.1 Patch04,
EK-ERTEC 200P PN IO: All versions prior to V4.4.0 Patch01,
EK-ERTEC 200 PN IO: All versions prior to V4.2.1 Patch03,
SIMATIC S7-200 SMART: All versions,
SIMATIC S7-300 including F and T: All versions prior to V3.X.14,
SIMATIC S7-400 including F and H: All versions,
SIMATIC S7-1200 including F: All versions prior to V4.2.1,
SIMATIC S7-1500 including F, T, and TF: All versions prior to V2.1,
SIMATIC S7-1500 Software Controller including F: All versions prior to V2.1,
SIMATIC WinAC RTX 2010 including F: All versions,
SIRIUS ACT 3SU1 interface module PROFINET: All versions,
SIRIUS Soft starter 3RW44 PN: All versions,
SIRIUS Motor starter M200D PROFINET: All versions,
SIMOCODE pro V PROFINET : All versions,
SINAMICS:

SINAMICS DCM: All versions,
SINAMICS DCP: All versions,
SINAMICS G110M / G120(C/P/D) w. PN: All versions prior to V4.7 SP6 HF3,
SINAMICS G130 and G150: All versions prior to V4.8 HF4,
SINAMICS S110 w. PN: All versions,
SINAMICS S120: All versions prior to V4.8 HF4,
SINAMICS S150: All versions prior to V4.8 HF4,
SINAMICS V90 w. PN: All versions,
SIMOTION: All versions prior to V4.5 HF1,
SINUMERIK 828D:

V4.5 and prior: All versions,
V4.7: All versions prior to V4.7 SP4 HF1,
SINUMERIK 840D sl:

V4.5 and prior: All versions prior to V4.5 SP6 HF8,
V4.7: All versions prior to V4.7 SP4 HF1, and
SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels: All versions.



### IMPACT

Successful exploitation of these vulnerabilities could cause the targeted device to enter a denial-of-service condition, which may require human interaction to recover the system.



### VULNERABILITY OVERVIEW

IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP broadcast packets could cause a denial-of-service condition of affected products on a local Ethernet segment (Layer 2).
Human interaction is required to recover the systems.
PROFIBUS interfaces are not affected.
CVE-2017-2680 has been assigned to this vulnerability.
A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)


IMPROPER INPUT VALIDATION CWE-20
Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial-of-service condition in that product.
Human interaction is required to recover the system.
PROFIBUS interfaces are not affected.
This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices.
CVE-2017-2681 has been assigned to this vulnerability.
A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)





### BACKGROUND

Critical Infrastructure Sectors: Critical Manufacturing, Food and Agriculture, Chemical, Energy, Water and Wastewater Systems
Countries/Areas Deployed: Worldwide
Company Headquarters Location: Germany




### MITIGATION

The attacker must have network access to the local Ethernet segment (Layer 2).

Siemens strongly recommends verifying that the affected products are protected as described in PROFINET Security Guidelines and Siemens Operational Guidelines in order to run the devices in a protected IT environment.

http://www.profibus.com/download/downloads/profinet-security-guideline/display/


https://www.siemens.com/cert/operational-guidelines-industrial-security


Siemens provides firmware updates fixing the vulnerabilities for the following affected products and recommends users update to the new fixed version:

SIMATIC CP 443-1 Std: Update to V3.2.17
https://support.industry.siemens.com/cs/ww/en/view/109745387


SIMATIC CP 443-1 Adv: Update to V3.2.17
https://support.industry.siemens.com/cs/ww/en/view/109745388


SIMATIC CM1542-1: Update to V2.0
https://support.industry.siemens.com/cs/ww/en/view/109744924


SIMATIC CP 1543-1: Update to V2.1
https://support.industry.siemens.com/cs/ww/en/view/109747253


SIMATIC RF650R, RF680R, RF685R: Update to V3.0
https://support.industry.siemens.com/cs/ww/en/view/109743740


SIMATIC CP 1616, CP 1604, DK-16xx PN IO: Update to V2.7
https://support.industry.siemens.com/cs/ww/en/view/109743058


SCALANCE W700: Update to V6.1.0
https://support.industry.siemens.com/cs/ww/en/view/109744953


IE/PB-Link: Upgrade to V3.0
https://support.industry.siemens.com/cs/ww/en/view/109744504


Development/Evaluation Kits for PROFINET IO:

DK Standard Ethernet Controller: All versions prior to V4.1.1 Patch04
EK-ERTEC 200P PN IO: All versions prior to V4.4.0 Patch01
EK-ERTEC 200 PN IO: All versions prior to V4.2.1 Patch03
Updates for Development/Evaluation Kits for PROFINET IO can be obtained via ComDeC at comdec@siemens.com


or pic.industry@siemens.com


SIMATIC S7-300 including F and T: Update to V3.X.14
https://support.industry.siemens.com/cs/ww/de/ps/13752/dl


or
https://support.industry.siemens.com/cs/ww/en/ps/13752/dl


SIMATIC S7-1200 including F: Update to V4.2
https://support.industry.siemens.com/cs/ww/en/view/109741461


SIMATIC S7-1500 including F, T and TF: Update to V2.1
https://support.industry.siemens.com/cs/ww/en/view/109478459


SIMATIC S7-1500 Software Controller including F: Update to V2.1
https://support.industry.siemens.com/cs/ww/en/view/109478528


SINAMICS:

SINAMICS G110M/G120(C/P/D) w. PN: Update to V4.7 SP6 HF3
https://support.industry.siemens.com/cs/ww/en/view/109482659


SINAMICS G130 and G150: V4.8: Update to V4.8 HF4
https://support.industry.siemens.com/cs/ww/en/view/109742040


SINAMICS S120: V4.8: Update to V4.8 HF4
https://support.industry.siemens.com/cs/de/en/view/109740193


SINAMICS S150: V4.8: Update to V4.8 HF4
https://support.industry.siemens.com/cs/ww/en/view/109742040


SIMOTION: Update to V4.5 HF1
https://support.industry.siemens.com/cs/ww/en/view/109742328


SINUMERIK 828D: V4.7: All versions prior to V4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager
SINUMERIK 840D sl:

V4.5 and prior: Update to V4.5 SP6 HF8
V4.7: Update to V4.7 SP4 HF1
SINUMERIK software can be obtained from the local Siemens account manager
Siemens is preparing updates for the remaining affected products and recommends the following mitigations in the meantime:

Apply cell protection concept
Use VPN for protecting network communication between cells
Apply Defense-in-Depth
As a general security measure Siemens and PNO strongly recommend protecting industrial control systems networks with appropriate mechanisms. Siemens encourages users to verify that the affected products are protected as described in PNO Security Guidelines and Siemens operational guidelines in order to run the devices in a protected IT environment.

https://www.siemens.com/cert/operational-guidelines-industrial-security


For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security Advisory SSA-293562 at the following location:

http://www.siemens.com/cert/en/cert-security-advisories.htm