17 December 2019

Multiple vulnerabilities in Siemens products

Siemens has released several security advisories on vulnerabilities identified in its industrial automation products.

Vulnerabilities have been identified in the following solutions:

A total of 7 vulnerabilities were identified in SiNVR 3, which, if exploited, could allow attackers to read and reset SiNVR 3 CCS (Central Control Server) user passwords, read the CCS and SiNVR user database, including all users’ passwords in obfuscated cleartext, extract device configuration files and passwords from the user database, etc. The greatest danger is posed by the following vulnerabilities:

  • CVE-2019-18337, an authentication bypass vulnerability in the XML-based communication protocol, and CVE-2019-18339, which has to do with missing authentication for critical functions. Both vulnerabilities were assigned a base score of 9.8.
  • CVE-2019-18342, which has to do with the lack of proper limitations in the SFTP service. A CVSS v.3 base score of 9.9 was calculated for this vulnerability.

Three vulnerabilities have been identified in XHQ Operations Intelligence product line (all versions prior to, which could allow an attacker to read or modify the contents of the web application:

CVSS v3 base scores of 8.1, 6.5 and 8.8, respectively, have been calculated for the above vulnerabilities.

Another two vulnerabilities, CVE-2018-18440 and CVE-2019-13103, have been identified in the RUGGEDCOM ROS switch. The former vulnerability has to do with improper restriction of operations within the bounds of a memory buffer, the latter with resource management errors. The CVSS v3 base scores calculated for these vulnerabilities are 7.8 and 4.6, respectively. Successful exploitation of these vulnerabilities could cause a denial-of-service condition or result in arbitrary code execution.

A number of vulnerabilities have also been identified in the EN100 Ethernet module. They include buffer overflow (CVE-2019-13942), XSS (CVE-2019-13943) and Path Traversal (CVE-2019-13944) flaws. CVSS v3 base scores calculated for these vulnerabilities are 7.5, 7.2 and 5.3, respectively.

If successfully exploited, these vulnerabilities could allow an attacker to execute code remotely, cause a denial-of-service condition and obtain sensitive information about the device.

The above vulnerabilities affect the following versions of the device:

  • EN100 Ethernet module for IEC 61850 (all versions prior to 4.37)
  • EN100 Ethernet module for PROFINET IO
  • EN100 Ethernet module for Modbus TCP
  • EN100 Ethernet module for DNP3
  • EN100 Ethernet module for IEC104

These devices are included in SIPROTEC 4 and SIPROTEC Compact.

Sources: ICS-CERT, Siemens