This security advisory describes one medium risk vulnerability.
1) Resource exhaustion
Severity: Medium
CVSSv3:
6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]
CVE-ID:
CVE-2019-10936
CWE-ID:
CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')
Exploit availability:
No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper resource management when processing UDP packets. A remote attacker can send a large amount of specially crafted UDP packets, trigger resource exhaustion and perform a denial of service (DoS) attack.
Mitigation
Install updates from vendor's website for the following products:
- Development/Evaluation Kits for PROFINET IO:
- DK Standard Ethernet Controller: All versions
- EK-ERTEC 200: All versions
- EK-ERTEC 200P: All versions
- SIMATIC CFU PA: All versions prior to 1.2.0
- SIMATIC ET 200AL: All versions
- SIMATIC ET 200M: All versions
- SIMATIC ET 200MP IM 155-5 PN BA: All versions prior to 4.2.3
- SIMATIC ET 200MP IM 155-5 PN HF: All versions
- SIMATIC ET 200MP IM 155-5 PN ST: All versions
- SIMATIC ET 200S: All versions
- SIMATIC ET 200SP IM 155-6 PN BA: All versions
- SIMATIC ET 200SP IM 155-6 PN HA: All versions
- SIMATIC ET 200SP IM 155-6 PN HF: All versions prior to 4.2.2
- SIMATIC ET 200SP IM 155-6 PN HS: All versions
- SIMATIC ET 200SP IM 155-6 PN ST: All versions
- SIMATIC ET 200SP IM 155-6 PN/2 HF: All versions prior to 4.2.2
- SIMATIC ET 200SP IM 155-6 PN/3 HF: All versions prior to 4.2.1
- SIMATIC ET 200ecoPN (except 6ES7148-6JD00-0AB0 and 6ES7146-6FF00-0AB0): All versions
- SIMATIC ET 200pro: All versions
- SIMATIC HMI Comfort Outdoor Panels 7" & 15": All versions
- SIMATIC HMI Comfort Panels 4" - 22": All versions
- SIMATIC HMI KTP Mobile Panels: All versions
- SIMATIC PN/PN Coupler: All versions
- SIMATIC PROFINET Driver: All versions prior to 2.1
- SIMATIC S7-1200 CPU family (incl. F): All versions
- SIMATIC S7-1500 CPU family (incl. F): All versions prior to 2.0
- SIMATIC S7-300 CPU family (incl. F): All versions
- SIMATIC S7-400 PN/DP V7 (incl. F): All versions
- SIMATIC S7-400 V6 (incl. F) and below: All versions
- SIMATIC S7-400H V6: All versions prior to 6.0.9
- SIMATIC S7-410 V8: All versions
- SIMATIC WinAC RTX (F) 2010: All versions prior to SP3
- SINAMICS DCM: All versions prior to 1.5 HF1
- SINAMICS DCP: All versions
- SINAMICS G110M v4.7 (PN Control Unit): All versions prior to 4.7 SP10 HF5
- SINAMICS G120 v4.7 (PN Control Unit): All versions prior to 4.7 SP10 HF5
- SINAMICS G130 v4.7 (Control Unit and CBE20): All versions
- SINAMICS G150 (Control Unit and CBE20): All versions
- SINAMICS GH150 v4.7 (Control Unit): All versions
- SINAMICS GL150 v4.7 (Control Unit): All versions
- SINAMICS GM150 v4.7 (Control Unit): All versions
- SINAMICS S110 (Control Unit): All versions
- SINAMICS S120 v4.7 (Control Unit and CBE20): All versions
- SINAMICS S150 (Control Unit and CBE20): All versions
- SINAMICS SL150 v4.7 (Control Unit): All versions
- SINAMICS SM120 v4.7 (Control Unit): All versions
- SINUMERIK 828D: All versions prior to 4.8 SP5
- SINUMERIK 840D sl: All versions
Vulnerable software versions
SINAMICS DCP:
-
SINUMERIK 840D sl:
-
SINUMERIK 828D:
-
SINAMICS SM120:
-
SINAMICS SL150:
-
SINAMICS S150:
-
SINAMICS S120:
-
SINAMICS S110:
-
SINAMICS GM150:
-
SINAMICS GL150:
-
SINAMICS GH150:
-
SINAMICS G150:
-
SINAMICS G130:
-
SINAMICS G120:
-
SINAMICS G110M:
-
SINAMICS DCM:
-
SIMATIC WinAC RTX (F) 2010:
-
SIMATIC S7-400H V6:
-
SIMATIC S7-410 V8:
-
SIMATIC S7-400 V6:
-
SIMATIC S7-400 PN/DP V7:
-
SIMATIC S7-300:
-
SIMATIC S7-1500 CPU:
1.0, 1.1, 1.5, 1.6, 1.7, 1.8
SIMATIC S7-1200:
2.00, 2.2, 2.3, 2.6, 3.0, 3.1, 4.0, 4.1, 4.1.1, 4.1.2, 4.2.3
SIMATIC PROFINET Driver:
-
SIMATIC PN/PN Coupler:
-
SIMATIC HMI KTP Mobile Panels:
-
SIMATIC HMI Comfort Panels 4”-22”:
-
SIMATIC HMI Comfort Outdoor Panels 7” & 15”:
-
SIMATIC ET 200pro:
-
SIMATIC ET 200ecoPN:
-
IM 155-6 PN/3 HF:
-
IM 155-6 PN/2 HF:
-
IM 155-6 PN ST:
-
IM 155-6 PN HS:
-
IM 155-6 PN HF:
-
IM 155-6 PN HA:
-
IM 155-6 PN BA:
-
SIMATIC ET 200S:
-
IM 155-5 PN ST:
-
IM 155-5 PN HF:
-
IM 155-5 PN BA:
-
SIMATIC ET 200M:
-
SIMATIC ET 200AL:
-
SIMATIC CFU PA:
1.0.1, 1.1.1, 1.1.2
CPE
External links
https://cert-portal.siemens.com/productcert/pdf/ssa-473245.pdf
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.