Summary
Two vulnerabilities have been identified in the SIMATIC
S7-1200/S7-1500 CPU families and related products. One vulnerability
(CVE-2019-10943) could allow an attacker with network access to
affected devices to modify the user program stored on these devices
such that the source code differs from the actual running code. The
other vulnerability (CVE-2019-10929) could allow an attacker in a Man-
in-the-Middle position to modify network traffic exchanged on port
102/tcp. Siemens has released updates for several affected
products to fix CVE-2019-10929 and recommends to update to the latest
versions. Regarding CVE-2019-10943, Siemens recommends specific
countermeasures for products where updates are not, or not yet
available.
Vulnerabilities 2
-
Unscored —
A vulnerability has been identified in SIMATIC CP 1626 (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC (…
-
Unscored —
A vulnerability has been identified in SIMATIC Drive Controller family (All versions), SIMATIC ET 200SP Open Controller…
Revision history
-
#5
Added SIMATIC Drive Controller and SIMATIC ET 200SP Open Controller CPU 1515SP PC as affected products; separate fix information for the different CVE IDs; updated fix release URL for SIMATIC S7-1200; reviewed mitigation measure
-
#4
Fix information about affected versions in product list.
-
#3
Removed exclusion of SIMATIC S7-1500 CPU 1518-4 PN/DP. Added solution for CVE-2019-10929 for ET200SP CPU 1515SP PC2 and SIMATIC S7-1500 Software Controller
-
#2
Added solution for CVE-2019-10929 for S7-1200 and S7-1500. SIPLUS devices now explicitly mentioned in the list of affected products
-
#1
Publication Date
References
-
SSA-232418: Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU Families - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-232418.pdf
-
SSA-232418: Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU Families - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-232418.txt