Summary
Siemens heeft kwetsbaarheden verholpen in diverse producten zoals Desigo, Industrial Plus, RUGGEDCOM, SIMATIC en SIPLUS.
Details
Interpretaties
De kwetsbaarheden stellen een kwaadwillende mogelijk in staat aanvallen uit te voeren die kunnen leiden tot de volgende categorieën schade:
- Denial-of-Service (DoS)
- Manipulatie van gegevens
- Omzeilen van een beveiligingsmaatregel
- (Remote) code execution (root/admin rechten)
- Toegang tot systeemgegevens
- Toegang tot gevoelige gegevens
- Verhogen van rechten
De kwaadwillende heeft hiervoor toegang nodig tot de productieomgeving. Het is goed gebruik een dergelijke omgeving niet publiek toegankelijk te hebben.
Oplossingen
Siemens heeft beveiligingsupdates uitgebracht om de kwetsbaarheden te verhelpen. Voor de kwetsbaarheden waar nog geen updates voor zijn, heeft Siemens mitigerende maatregelen gepubliceerd om de risico's zoveel als mogelijk te beperken. Zie de bijgevoegde referenties voor meer informatie.
Vulnerabilities 41
-
Critical 9.8
SQLite sqldiff remote code execution via argument injection
SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' option to load an arbitrary DLL with a crafted command line argument string that results in com…
-
Critical 9.6
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an att…
-
Critical 9.6
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the…
-
Critical 9.6
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before …
-
Critical 9.1
Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow a…
-
High 8.8
A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Updat…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly valid…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly valid…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly valid…
-
High 8.8
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restr…
-
High 8.3
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to…
-
High 7.8
SQLite before 3.53.2 Heap Buffer Overflow via FTS5 fts5ChunkIterate
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifyi…
-
High 7.7
A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions…
-
High 7.5
An information disclosure issue in the zipfileInflate function in the zipfile extension in SQLite v3.51.1 and earlier a…
-
High 7.5
PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter
The PickPlugins Question Answer plugin for WordPress is vulnerable to SQL Injection in versions up to and including 1.2.73. This is due to insufficient sanitization of user-supplied input via the 'id' GET parameter in the user profile template combined with t…
-
High 7.5
Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0
An improper certificate/host key validation vulnerability was discovered in the Smart Polling functionality, which established encrypted connections to target devices without validating the remote host's identity, and no option was provided to enable it. A ma…
-
High 7.5
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affec…
-
High 7.5
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly valid…
-
High 7.4
Incorrect authorization in Credentials Manager in Guardian/CMC before 26.3.0
An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges. A remote authenticated user with limited privileges can view a limited subset of the available entries in the Credential…
-
High 7.4
A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software do…
-
High 7.2
Integer Truncation on SQLite
There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. This could lead to a memory corruption issue. We recommend upgrading to version 3.50.2 or above.
-
High 7.0
Out of Bound Write on WibuKey for Windows
In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under…
-
Medium 6.8
A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, I…
-
Medium 6.7
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly valid…
-
Medium 6.5
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perfo…
-
Medium 6.3
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perfo…
-
Medium 6.3
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perfo…
-
Medium 6.1
Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CS…
-
Medium 6.1
Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering…
-
Medium 6.1
Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in s…
-
Medium 6.1
Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before includin…
-
Medium 6.1
Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before r…
-
Medium 5.8
Dos in ZigBee device due to unsolicited encrypted rejoin response
A ZigBee coordinator, router, or end device may change their node ID when an unsolicited encrypted rejoin response is received, this change in node ID causes Denial of Service (DoS). To recover from this DoS, the network must be re-established
-
Medium 5.5
SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page. Attackers can set an oversized term length in …
-
Medium 5.5
A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affec…
-
Medium 5.4
Incorrect authorization in Smart Polling configuration in Guardian/CMC before 26.3.0
An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges. An authenticated user with limited privileges can remotely bypass the intended access control of the web managem…
-
Medium 5.4
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restr…
-
Medium 5.3
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
Medium 4.6
Insufficient sanitization of Dashboards in Guardian/CMC before 26.3.0
A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter. An authenticated user with the required privileges can define a dashboard containing a malicious payload, or a victim can be so…
-
Medium 4.3
A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restr…
-
Low 3.5
Cross-site request forgery in the Guardian/CMC login before 26.3.0
A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token. An attacker with a valid account can trick a victim into unknowingly authenticating with the attack…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-099819.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-148322.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-159454.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-225816.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-333035.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-377139.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-390352.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-485750.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-508506.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-550198.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-591731.html
-
Reference
https://cert-portal.siemens.com/productcert/html/ssa-968435.html