Skip to content
OpenAdvisories
High SSA-307392 1 CVE

SSA-307392: Denial of Service in OPC UA in Industrial Products

Published Apr 9, 2019 · Updated Aug 9, 2022 · Revision 10

Vendor: Siemens Product: SIMATIC CP 443-1 OPC UA Product: SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) Product: SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants) Product: SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants) Product: SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900 and KTP900F Product: SIMATIC IPC DiagMonitor Product: SIMATIC NET PC Software V13 Product: SIMATIC NET PC Software V14 Product: SIMATIC NET PC Software V15 Product: SIMATIC RF188C Product: SIMATIC RF600R family Product: SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) Product: SIMATIC S7-1500 Software Controller Product: SIMATIC WinCC OA Product: SIMATIC WinCC Runtime Advanced Product: SINEC NMS Product: SINEMA Server Product: SINUMERIK OPC UA Server Product: TeleControl Server Basic

Summary

A vulnerability has been identified in the OPC UA server of several
industrial products. The vulnerability could cause a denial of
service condition on the service or the device. Siemens has
released updates for several affected products and recommends to
update to the latest versions. Siemens recommends specific
countermeasures for products where updates are not, or not yet
available.

Vulnerabilities 1

Revision history

  1. #10

    Added fix for TeleControl Server Basic

  2. #9

    Added solution for SIMATIC NET PC Software V14 and clarified affected versions; no remediation planned for V15

  3. #8

    No remediation planned for SIMATIC CP 443-1 OPC UA

  4. #7

    Added updates for SIMATIC IPC DiagMonitor and SINEC

  5. #6

    Added updates for SIMATIC NET PC Software

  6. #5

    Added updates for SIMATIC Panels and SIMATIC WinCC Runtime Advanced. SIPLUS devices now explicitly mentioned in the list of affected products

  7. #4

    Added update for SIMATIC RF600R, SIMATIC RF188C and SINEMA Server

  8. #3

    Added update for SIMATIC Software Controller and SIMATIC ET 200 SP Open Controller CPU 1515SP PC2

  9. #2

    Clarify productnames for SIMATIC HMI Products, added solution for SIMATIC S7-1500 CPU family, modified affected versions for SIMATIC Net PC Software

  10. #1

    Publication Date

References