Siemens SIMATIC Vulnerability Advisory CVE-2019-10929

Critical Vulnerability Information 1. Vulnerability Overview CVSS Score: v3.3.7 Note: Remotely exploitable Vendor: Siemens Affected Devices: SIMATIC CP 1626, HMI Panels (including SIPLUS variants), NET PC Software, STEP 7 (TIA Portal), WinCC (TIA Portal), WinCC OA, WinCC Runtime (Pro and Advanced), TIM 1531 IRC (including SIPLUS variants) Vulnerability Type: Exposure of Dangerous Method or Function 2. Update Information This update notice is a follow-up to the ICSA-19-344-04 Siemens SIMATIC Products update notice released on March 10, 2020, updated to Update C. 3. Risk Assessment Successful exploitation of this vulnerability allows an attacker in a man-in-the-middle position to modify network traffic exchanged over port 102/TCP. 4. Technical Details 4.1 Affected Products SIMATIC CP 1626: All versions SIMATIC NET PC Software v14: Versions prior to v14 SP1 Update 14 SIMATIC NET PC Software v15: All versions SIMATIC HMI Panels (including SIPLUS variants): All versions SIMATIC STEP 7 (TIA Portal): Versions prior to v16 SIMATIC WinCC (TIA Portal): Versions prior to v16 SIMATIC WinCC OA: Versions v3.15 and earlier (including v3.15) SIMATIC WinCC OA: Versions v3.16 patch 12 and earlier (including v3.16 patch 12) SIMATIC WinCC Runtime Advanced: All versions SIMATIC WinCC Runtime Professional: All versions TIM 1531 IRC (including SIPLUS NET variants): Versions prior to v2.1 4.2 Vulnerability Overview CVE-2019-10929: Use of a Broken or Risky Cryptographic Algorithm (CWE-327) An attacker in a man-in-the-middle position can modify network traffic exchanged over port 102/TCP. Successful exploitation requires a man-in-the-middle attack. Subsequent exploitation of this vulnerability can compromise the communication integrity of infected systems. CVSS Score: v3.1 Base Score 3.7 5. Mitigation Measures Siemens has released updates for the affected products and recommends users upgrade to the new versions. It is strongly recommended to implement a defense-in-depth strategy and appropriately secure network access to devices. Organizations should conduct appropriate impact analysis and risk assessment before deploying protective measures. CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.

Goal Reached Thanks to every supporter — we hit 100%!

Siemens SIMATIC Vulnerability Advisory CVE-2019-10929