Multiple vulnerabilities in Siemens Industrial Products
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2018-18065 CVE-2015-5621 |
| CWE-ID | CWE-476 CWE-264 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software Subscribe |
SIMATIC CP 1628 Hardware solutions / Firmware SIMATIC CP 1623 Hardware solutions / Firmware SCALANCE S627-2M Hardware solutions / Firmware SCALANCE S623 Hardware solutions / Firmware SCALANCE S612 Hardware solutions / Firmware SCALANCE S602 Hardware solutions / Firmware TIM 1531 IRC Hardware solutions / Firmware IE/PB LINK PN IO Hardware solutions / Routers & switches, VoIP, GSM, etc SIMATIC CP443-1 OPC UA Server applications / SCADA systems SIMATIC CP 443-1 Standard Server applications / SCADA systems SIMATIC CP 443-1 Advanced Server applications / SCADA systems SIMATIC CP 343-1 Advanced Server applications / SCADA systems SIMATIC CP 1626 Server applications / SCADA systems |
| Vendor | Siemens |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Null pointer dereference
EUVDB-ID: #VU15322
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2018-18065
CWE-ID:
CWE-476 - NULL Pointer Dereference
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.
The vulnerability exists in the _set_key() function, as defined in the agent/helpers/table_container.c source code file due to a NULL pointer exception bug. A remote attacker can send a malicious UDP packet, trigger a NULL pointer dereference condition, cause the application to crash.
MitigationInstall updates from vendor's website.
Vulnerable software versionsSIMATIC CP 1628: before 14.00.15.00_51.25.00.01
SIMATIC CP 1623: before 14.00.15.00_51.25.00.01
IE/PB LINK PN IO: All versions
SIMATIC CP443-1 OPC UA: All versions
SCALANCE S627-2M: All versions
SCALANCE S623: All versions
SCALANCE S612: All versions
SCALANCE S602: All versions
TIM 1531 IRC: All versions
SIMATIC CP 443-1 Standard: All versions
SIMATIC CP 443-1 Advanced: All versions
SIMATIC CP 343-1 Advanced: All versions
SIMATIC CP 1626: All versions
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-042-02
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Remote code execution
EUVDB-ID: #VU2215
Risk: High
CVSSv3.1: 8.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2015-5621
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The weakness exists due to the snmp_pdu_parse function in snmp_api.c does not remove the varBind variable in a netsnmp_variable_list item when parsing of the SNMP PDU fails. A remote attacker can supply specially crafted input and cause denial of service or execute arbitrary code with elevated privileges.
Install updates from vendor's website.
Vulnerable software versionsSIMATIC CP 1628: before 14.00.15.00_51.25.00.01
SIMATIC CP 1623: before 14.00.15.00_51.25.00.01
IE/PB LINK PN IO: All versions
SIMATIC CP443-1 OPC UA: All versions
SCALANCE S627-2M: All versions
SCALANCE S623: All versions
SCALANCE S612: All versions
SCALANCE S602: All versions
TIM 1531 IRC: All versions
SIMATIC CP 443-1 Standard: All versions
SIMATIC CP 443-1 Advanced: All versions
SIMATIC CP 343-1 Advanced: All versions
SIMATIC CP 1626: All versions
External linkshttp://ics-cert.us-cert.gov/advisories/icsa-20-042-02
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
