Summary
Security researchers discovered and disclosed 33 vulnerabilities in several open-source TCP/IP stacks for embedded devices, also known as "AMNESIA:33" vulnerabilities.
This advisory describes the impact of two of these vulnerabilities (CVE-2020-13987, CVE-2020-17437) to Siemens products.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not available.
The impact of another "AMNESIA:33" vulnerability (CVE-2020-13988) is described in Siemens Security Advisory SSA-541017.
Vulnerabilities 2
-
Unscored —
An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack comp…
-
Unscored —
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP pac…
Revision history
-
#6
Added download link of update version for SENTRON PAC2200
-
#5
Added solution for SENTRON PAC2200 (with and without MID approval)
-
#4
Added solution for PAC3200T
-
#3
Added solution for SENTRON 3VA COM100/800 and DSP800
-
#2
Added download link of update version for SENTRON PAC3220
-
#1
Publication Date
References
-
SSA-541018: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Part 2) - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf
-
SSA-541018: Embedded TCP/IP Stack Vulnerabilities (AMNESIA:33) in SENTRON PAC / 3VA Devices (Part 2) - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-541018.txt