Multiple vulnerabilities in Siemens SIMATIC panels

1) Path traversal

EUVDB-ID: #VU15887

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-13812

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to directory traversal. A remote attacker with network access to the integrated web server can conduct directory traversal attack and download of arbitrary files from the device.

Mitigation

Update the affected products to version 15 Update 4.

Vulnerable software versions

Siemens SIMATIC WinCC: All versions

SIMATIC HMI MP Mobile Panel: All versions

SIMATIC HMI OP: All versions

SIMATIC HMI MP: All versions

SIMATIC HMI TP: All versions

SIMATIC WinCC Runtime Advanced: All versions

SIMATIC HMI KTP900F: All versions

SIMATIC HMI KTP900: All versions

SIMATIC HMI KTP700F: All versions

SIMATIC HMI KTP700: All versions

SIMATIC HMI KTP400F: All versions

SIMATIC HMI Comfort Outdoor Panels 7” & 15”: All versions

SIMATIC HMI Comfort Panels 4”-22”: All versions

SIMATIC WinCC Runtime Professional: All versions

CPE2.3

• cpe:2.3:a:siemens:siemens_simatic_wincc:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_mp_mobile_panel:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_op:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_mp:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_tp:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp900f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp900:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp700f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp700:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp400f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_comfort_outdoor_panels_7”_and_15”:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_comfort_panels_4”-22”:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-08

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Open redirect

EUVDB-ID: #VU15888

Risk: Low

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-13813

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

Description

The vulnerability allows a remote attacker to redirect victims to arbitrary URI.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary URI.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information

Mitigation

Update the affected products to version 15 Update 4.

Vulnerable software versions

Siemens SIMATIC WinCC: All versions

SIMATIC HMI MP Mobile Panel: All versions

SIMATIC HMI OP: All versions

SIMATIC HMI MP: All versions

SIMATIC HMI TP: All versions

SIMATIC WinCC Runtime Advanced: All versions

SIMATIC HMI KTP900F: All versions

SIMATIC HMI KTP900: All versions

SIMATIC HMI KTP700F: All versions

SIMATIC HMI KTP700: All versions

SIMATIC HMI KTP400F: All versions

SIMATIC HMI Comfort Outdoor Panels 7” & 15”: All versions

SIMATIC HMI Comfort Panels 4”-22”: All versions

SIMATIC WinCC Runtime Professional: All versions

CPE2.3

• cpe:2.3:a:siemens:siemens_simatic_wincc:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_mp_mobile_panel:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_op:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_mp:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_tp:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp900f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp900:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp700f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp700:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp400f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_comfort_outdoor_panels_7”_and_15”:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_comfort_panels_4”-22”:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-08

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) HTTP header injection

EUVDB-ID: #VU15889

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-13814

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Exploit availability: No

Description

The vulnerability allows a remote attacker to inject HTTP header on the target system.

The vulnerability exists due to insufficient validation of user-supplied input. A remote unauthenticated attacker can trick the victim into clicking on a malicious link and use integrated web server (Port 80/TCP and Port 443/TCP) inject HTTP headers.

Mitigation

Update all affected products to version 15 Update 4.

Vulnerable software versions

SIMATIC HMI Comfort Panels 4”-22”: All versions

SIMATIC HMI Comfort Outdoor Panels 7” & 15”: All versions

SIMATIC HMI KTP900F: All versions

SIMATIC HMI KTP900: All versions

SIMATIC HMI KTP700F: All versions

SIMATIC HMI KTP700: All versions

SIMATIC HMI KTP400F: All versions

SIMATIC WinCC Runtime Professional: All versions

SIMATIC WinCC Runtime Advanced: All versions

SIMATIC WinCC (TIA Portal): All versions

SIMATIC HMI MP Mobile Panel: All versions

SIMATIC HMI OP: All versions

SIMATIC HMI MP: All versions

SIMATIC HMI TP: All versions

CPE2.3

• cpe:2.3:a:siemens:simatic_hmi_comfort_panels_4”-22”:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_comfort_outdoor_panels_7”_and_15”:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp900f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp900:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp700f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp700:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_ktp400f:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_runtime_professional:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_runtime_advanced:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_wincc_tia_portal:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_mp_mobile_panel:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_op:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_mp:*:*:*:*:*:*:*:*
• cpe:2.3:a:siemens:simatic_hmi_tp:*:*:*:*:*:*:*:*

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-317-03

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.