Multiple vulnerabilities in Siemens SIMATIC MV500 Devices

1) Heap-based buffer overflow

EUVDB-ID: #VU66153

Risk: High

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-37434

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing a large gzip header within inflateGetHeader in inflate.c. A remote attacker can pass a specially crafted file to the affected application, trigger heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Allocation of Resources Without Limits or Throttling

EUVDB-ID: #VU78233

Risk: High

CVSSv3.1: 7.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-36521

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to allocation of resources without limits or throttling. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Resource exhaustion

EUVDB-ID: #VU78232

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-35921

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing specially crafted Ethernet frames. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Resource exhaustion

EUVDB-ID: #VU78231

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-35920

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources when processing specially crafted IP packets. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Type Confusion

EUVDB-ID: #VU71992

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0286

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error related to X.400 address processing inside an X.509 GeneralName. A remote attacker can pass specially crafted data to the application, trigger a type confusion error and perform a denial of service (DoS) attack or read memory contents.

In most cases, the attack requires the attacker to provide both the certificate chain and CRL, neither of which need to have a valid signature. If the attacker only controls one of these inputs, the other input must already contain an X.400 address as a CRL distribution point, which is uncommon. As such, this vulnerability is most likely to only affect applications which have implemented their own functionality for retrieving CRLs over a network.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU71995

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0215

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error within the BIO_new_NDEF function. A remote attacker can trigger a use-after-free error and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Path traversal

EUVDB-ID: #VU73970

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-48285

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to insufficient sanitization of user-supplied in the loadAsync() method. A remote attacker can pass a specially crafted ZIP archive to the application and overwrite arbitrary files on the system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Input validation error

EUVDB-ID: #VU66476

Risk: Medium

CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-36946

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within the nfqnl_mangle() function in net/netfilter/nfnetlink_queue.c in the Linux kernel when processing IPv6 packets. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

9) Out-of-bounds write

EUVDB-ID: #VU64419

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-14196

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error within the nfs_lookup_reply() function in net/nfs.c. A remote attacker can create a specially crafted data to the application, trigger an out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Buffer overflow

EUVDB-ID: #VU64420

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-30767

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error within the nfs_lookup_reply() function in net/nfs.c. A remote attacker can pass specially crafted data to the application, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Note, the vulnerability exists due to incomplete fix for CVE-2019-14196.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Double Free

EUVDB-ID: #VU71996

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-4450

CWE-ID: CWE-415 - Double Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error within the PEM_read_bio_ex() function. A remote attacker can pass specially crafted PEM file to the application, trigger a double free error and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Information Exposure Through Timing Discrepancy

EUVDB-ID: #VU71993

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-4304

CWE-ID: CWE-208 - Information Exposure Through Timing Discrepancy

Exploit availability: No

Description

The vulnerability allows a remote attacker to obtain sensitive information.

The vulnerability exists due to a timing based side channel exists in the OpenSSL RSA Decryption implementation. A remote attacker can perform a Bleichenbacher style attack and decrypt data sent over the network.

To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Memory leak

EUVDB-ID: #VU64079

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-1012

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient randomization in the net/ipv4/tcp.c when calculating port offsets in Linux kernel cause by small table perturb size. A remote attacker can cause memory leak and gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Resource exhaustion

EUVDB-ID: #VU66152

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-46828

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to library improperly handles idle TCP connections. A remote attacker can exhaust the file descriptors of a process that uses libtirpc and perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

SIMATIC MV560 X: before 3.3.4

SIMATIC MV560 U: before 3.3.4

SIMATIC MV550 S: before 3.3.4

SIMATIC MV550 H: before 3.3.4

SIMATIC MV540 S: before 3.3.4

SIMATIC MV540 H: before 3.3.4

CPE2.3

External links

http://cert-portal.siemens.com/productcert/txt/ssa-561322.txt

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	14
CVE-ID	CVE-2022-37434 CVE-2023-36521 CVE-2023-35921 CVE-2023-35920 CVE-2023-0286 CVE-2023-0215 CVE-2022-48285 CVE-2022-36946 CVE-2019-14196 CVE-2022-30767 CVE-2022-4450 CVE-2022-4304 CVE-2022-1012 CVE-2021-46828
CWE-ID	CWE-122 CWE-770 CWE-400 CWE-843 CWE-416 CWE-22 CWE-20 CWE-787 CWE-119 CWE-415 CWE-208 CWE-401
Exploitation vector	Network
Public exploit	Public exploit code for vulnerability #1 is available. Public exploit code for vulnerability #8 is available.
Vulnerable software	SIMATIC MV560 X Hardware solutions / Firmware SIMATIC MV560 U Hardware solutions / Firmware SIMATIC MV550 S Hardware solutions / Firmware SIMATIC MV550 H Hardware solutions / Firmware SIMATIC MV540 S Hardware solutions / Firmware SIMATIC MV540 H Hardware solutions / Firmware
Vendor	Siemens