Siemens SIMATIC S7-1500 Unauthenticated Information Disclosure (CVE-2024-46887)

Key Information Vulnerability Description Vulnerability ID: SSA-054046 Vulnerability Type: Unauthenticated Information Disclosure in Web Server of SIMATIC S7-1500 CPUs Affected Products: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) Affected Versions: V1.0 CVSS v3.1 Base Score: 5.3 CVSS v4.0 Base Score: 6.9 Impact Scope Affected Products: SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced Affected Versions: All versions affected by CVE-2024-46887 Remediation Affected Products and Versions: SIMATIC Drive Controller family Remediation Recommendation: Update to V3.1.4 or later version Affected Products and Versions: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) Remediation Recommendation: Currently no fix is available Affected Products and Versions: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) Remediation Recommendation: Open for details Affected Products and Versions: SIMATIC S7-1500 Software Controller Remediation Recommendation: Currently no fix is available Affected Products and Versions: SIMATIC S7-PLCSIM Advanced Remediation Recommendation: Currently no fix is available Workarounds and Mitigations Workarounds and Mitigations: Specific mitigations or workarounds for affected products can be found in the “Affected Products and Remediation” section. General Security Recommendations General Security Recommendations: As a general security measure, it is recommended to configure the environment to protect network access and follow industrial security operational guidelines. Product Description Product Description: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) Vulnerability Description Vulnerability Description: The web server of the affected device does not properly validate user requests to the "/ClientArea/RuntimeInfoData.mwsl" endpoint. This may allow an unauthenticated remote attacker to obtain the current actual and configured maximum cycle time, as well as the configured maximum communication load. Authentication Information Authentication Information: Corstiaan Klos Additional Information Additional Information: For inquiries regarding security vulnerabilities in Siemens products, please contact Siemens ProductCERT. Historical Data Historical Data: V1.0 (2024-10-08): Publication Date Terms and Use Terms and Use: Siemens Security Advisories are subject to Siemens’ license terms or any other applicable agreements previously entered into with Siemens. Where applicable, the terms and use of Siemens Security Advisory (https://www.siemens.com/terms_of_use) shall apply, particularly Sections 8–10. In case of conflict, license terms shall take precedence over use terms.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SIMATIC S7-1500 Unauthenticated Information Disclosure (CVE-2024-46887)