Overview
On April 9, local time, Siemens officially released a security advisory, announcing the fix of vulnerabilities of different risk levels in a spectrum of products such as SIMATIC WinCC Open Architecture (SIMATIC WinCC OA), Spectrum Power, and RUGGEDCOM RXO II. Of all these vulnerabilities, two have a CVSS v3.0 base score of 10.
For details about all these vulnerabilities, refer to the security advisory at the following link:
https://new.siemens.com/global/en/products/services/cert.html#SecurityPublications
High-Risk Vulnerabilities
SIMATIC WinCC OA Remote Code Execution Vulnerability (CVE-2018-3991)
SIMATIC WinCC OA contains a vulnerability (CVE-2018-3991) due to improper access control of TCP port 22347. Successful exploitation of this vulnerability could result in a heap overflow which potentially triggers arbitrary code execution.
CVSS v3.0 Base Score 10.0
- Affected versions:
- SIMATIC WinCC OA Version 3.14 < P025
- SIMATIC WinCC OA Version 3.15 < P018
- SIMATIC WinCC OA Version 3.16 < P007
- Unaffected versions:
- SIMATIC WinCC OA Version 3.14 PO25
- SIMATIC WinCC OA Version 3.15 PO18
- SIMATIC WinCC OA Version 3.16 P007
Solution
Siemens has released patches to fix the preceding vulnerabilities. For more information, visit the following link:
https://cert-portal.siemens.com/productcert/pdf/ssa-844562.pdf
Spectrum Power 4.7 Command Injection Vulnerability (CVE-2019-6579)
An attacker with access to TCP port 80 or 443 could execute system commands with administrative privileges.
CVSS v3.0 Base Score 10.0
- Affected versions:
- Spectrum Power 4 with Web Office Portal suffers from this issue.
Solution
Siemens has released patches for the affected product. For details, visit the following link:
https://cert-portal.siemens.com/productcert/pdf/ssa-324467.pdf
RUGGEDCOM ROX II – CVE-2018-5379
Certain releases of the Quagga BGP daemon (bgpd) can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes. A successful attack could cause a denial of service or potentially allow an attacker to execute arbitrary code.
CVSS v3.0 Base Score 9.8
- Affected versions:
- RUGGEDCOM ROX II version < V2.13.0
- Unaffected versions:
- RUGGEDCOM ROX II version V2.13.0
Solution
Siemens has released patches for the affected product. For details, visit the following link:
https://cert-portal.siemens.com/productcert/pdf/ssa-451142.pdf
-
Statement
This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.
-
About NSFOCUS
NSFOCUS IB is a wholly owned subsidiary of NSFOCUS, an enterprise application and network security provider, with operations in the Americas, Europe, the Middle East, Southeast Asia and Japan. NSFOCUS IB has a proven track record of combatting the increasingly complex cyber threat landscape through the construction and implementation of multi-layered defense systems. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide unified, multi-layer protection from advanced cyber threats.
For more information about NSFOCUS, please visit:
NSFOCUS, NSFOCUS IB, and NSFOCUS, INC. are trademarks or registered trademarks of NSFOCUS, Inc. All other names and trademarks are property of their respective firms.
