Skip to content
OpenAdvisories
Medium SSA-285795 1 CVE

SSA-285795: Denial of Service in OPC-UA in Industrial Products

Published May 10, 2022 · Updated Oct 10, 2023 · Revision 5

Vendor: Siemens Product: SIMATIC HMI Comfort Outdoor Panels (incl. SIPLUS variants) Product: SIMATIC HMI Comfort Panels (incl. SIPLUS variants) Product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F Product: SIMATIC NET PC Software V14 Product: SIMATIC NET PC Software V15 Product: SIMATIC NET PC Software V16 Product: SIMATIC NET PC Software V17 Product: SITOP Manager Product: TeleControl Server Basic V3

Summary

A vulnerability in the underlying third party component OPC UA ANSIC Stack (also called Legacy C-Stack) affects several industrial products. The vulnerability could cause a crash of the component that includes the vulnerable part of the stack.

Siemens has released updates for the affected products and recommends to update to the latest versions.

Vulnerabilities 1

  • Unscored —
    CVE-2021-45117

    The OPC autogenerated ANSI C stack stubs (in the NodeSets) do not handle all error cases. This can lead to a NULL point…

Revision history

  1. #5

    Added fix for SITOP Manager

  2. #4

    Added SIMATIC HMI Comfort Outdoor Panels and SIMATIC HMI KTP Mobile Panels to list of affected products

  3. #3

    Added fix for TeleControl Server Basic

  4. #2

    Added fix for SIMATIC NET PC Software V16

  5. #1

    Publication Date

References