Summary
SINEC NMS versions before V1.0.3 are affected by a vulnerability in the logback component (CVE-2021-42550) that could allow attackers with write access to the logback configuration file to execute arbitrary code on the system.
Siemens has released an update for SINEC NMS and recommends to update to the latest version.
Vulnerabilities 1
-
Medium 6.6
RCE from attacker with configuration edit priviledges through JNDI lookup
In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
Revision history
-
#1
Publication Date
References
-
SSA-371761: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3 - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-371761.txt
-
SSA-371761: Arbitrary Code Execution Vulnerability in the Logback Component of SINEC NMS before V1.0.3 - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-371761.pdf
-
ICS Advisory ICSA-22-314-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-314-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B