Summary
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities.
This advisory describes the impact of one of these vulnerabilities (CVE-2020-13988) to Siemens products. Siemens has released updates for the affected products and recommends to update to the latest versions.
The impact of additional "AMNESIA:33" vulnerabilities is described in Siemens Security Advisory SSA-541018.
Vulnerabilities 1
-
Unscored —
An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsi…
Revision history
-
#4
Added download link for SENTRON PAC3200T
-
#3
Added solution for SIRIUS 3RW5 communication module Modbus TCP; added reference to additional AMNESIA:33 advisory (SSA-541018)
-
#2
Added additional affected products (SENTRON PAC2200, PAC3200T, 3VA COM100/800, 3VA DSP800) and related fix release information
-
#1
Publication Date
References
-
SSA-541017: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SIRIUS 3RW5 Modbus TCP and SENTRON PAC / 3VA Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-541017.pdf
-
SSA-541017: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SIRIUS 3RW5 Modbus TCP and SENTRON PAC / 3VA Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-541017.txt