Summary
Several Siemens industrial products are affected by a vulnerability in
OpenSSL, that could result in data being sent out unencrypted by the
SSL/TLS record layer. Siemens has released updates for the affected
products and recommends to update to the latest versions.
Vulnerabilities 1
-
Unscored —CVE-2017-3737 EPSS 79%
OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal erro…
Revision history
-
#8
Added fix for SIMATIC STEP 7 (TIA Portal) V14; updated fix information for SIMATIC IPC DiagBase and DiagMonitor
-
#7
SIPLUS devices now explicitly mentioned in the list of affected products
-
#6
Added update for SIMATIC IPC DiagBase and SIMATIC WinCC (TIA Portal) V14
-
#5
Added update for SIMATIC S7-1500 Software Controller, SIMATIC ET 200SP Open Controller CPU 1515SP PC
-
#4
Added update for SIMATIC HMI WinCC Flexible, SIMATIC IPC DiagMonitor
-
#3
Added update for SIMATIC S7-1200 CPU, SIMATIC STEP 7 (TIA Portal) V13, SIMATIC WinCC (TIA Portal) V13
-
#2
Added WinCC OA patches, removed OC1 variant indicator as F is also affected
-
#1
Publication Date
References
-
SSA-179516 OpenSSL Vulnerability in Industrial Products - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-179516.pdf
-
SSA-179516 OpenSSL Vulnerability in Industrial Products - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-179516.txt