Summary
Unified Automation .NET based OPC UA Server SDK before 3.2.2 used in several industrial products are affected by a similar vulnerability as documented in CVE-2023-27321 for the OPC Foundation UA .NET Standard implementation. A successful attack may lead to high load situation and memory exhaustion, and may block the OPC UA server.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
Medium 5.3
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.5), SIMATIC Energy Manager PRO (…
Revision history
-
#3
Revision - Fixing typos
-
#2
Updated currently no fix planned for SIMATIC IPC DiagBase and SIMATIC IPC DiagMonitor
-
#1
Publication Date
References
-
SSA-088132: Denial of Service Vulnerability in the OPC UA Server Implementations of Several Industrial Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-088132.html
-
ICS Advisory ICSA-24-193-07 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-193-07
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B