Summary
The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames.
Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
Vulnerabilities 1
-
Medium 5.3
The login functionality of the web server in affected devices does not normalize the response times of login attempts. …
Revision history
-
#3
Revision - Fixing typos
-
#2
Added fix for SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants)
-
#1
Publication Date
References
-
SSA-195895: User Enumeration Vulnerability in the Webserver of SIMATIC Products - HTML Version
https://cert-portal.siemens.com/productcert/html/ssa-195895.html
-
ICS Advisory ICSA-25-044-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-044-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B