Summary
SINUMERIK ONE and SINUMERIK MC products are affected by a memory protection bypass vulnerability in the integrated S7-1500 CPU that could allow an attacker to write arbitrary data and code to protected memory areas or read sensitive data to launch further attacks on the CPU.
Siemens has released updates for the affected products and recommends that customers update to the new version.
Vulnerabilities 1
-
Critical 9.8
A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open C…
Revision history
-
#3
Revision - Fixing typos
-
#2
Added solution for SINUMERIK MC and SINUMERIK ONE
-
#1
Publication Date
References
-
SSA-434536: Memory Protection Bypass Vulnerability in SINUMERIK ONE and SINUMERIK MC - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-434536.txt
-
SSA-434536: Memory Protection Bypass Vulnerability in SINUMERIK ONE and SINUMERIK MC - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-434536.pdf
-
ICS Advisory ICSA-21-194-17 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-194-17
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B