Skip to content
OpenAdvisories
Critical 2 exploited CVEs SSA-661247 2 CVEs

SSA-661247: Apache Log4j Vulnerabilities (Log4Shell, CVE-2021-44228, CVE-2021-45046) - Impact to Siemens Products

Published Dec 13, 2021 · Updated Aug 9, 2022 · Revision 21

Vendor: Siemens Product: Advantage Navigator Energy & Sustainability Product: Advantage Navigator Software Proxy V6 Product: Building Operator Discovery Distribution for the Connect X200 Gateway Product: Building Operator Discovery Distribution for the Connect X300 Gateway Product: Building Twin - 360° Viewer Product: Capital V2019.1 Product: Capital V2020.1 Product: Capital V2021.1 Product: Cerberus DMS V5.0 Product: Cerberus DMS V5.1 Product: COMOS Product: cRSP Product: cRSP Operator Client Starter Product: Desigo CC V3.0 Product: Desigo CC V4.0 Product: Desigo CC V4.1 Product: Desigo CC V4.2 Product: Desigo CC V5.0 Product: Desigo CC V5.1 Product: E-Car OC Cloud Application Product: Energy Engage Product: EnergyIP Product: EnergyIP Prepay Product: Enlighted Amaze Product: Enlighted Where Product: Geolus Shape Search V10 Product: Geolus Shape Search V11 Product: GMA-Manager Product: HEEDS Connect +111 more

Summary

On 2021-12-09, a vulnerability in Apache Log4j (a logging tool used in
many Java-based applications) was disclosed, that could allow remote
unauthenticated attackers to execute code on vulnerable systems. The
vulnerability is tracked as CVE-2021-44228 and is also known as
"Log4Shell". On 2021-12-14 an additional denial of service
vulnerability (CVE-2021-45046) was published rendering the initial
mitigations and fix in version 2.15.0 as incomplete under certain non-
default configurations. Log4j versions 2.16.0 and 2.12.2 are supposed
to fix both vulnerabilities. On 2021-12-17, CVE-2021-45046 was
reclassified with an increased CVSS base score (from 3.7 to 9.0). The
potential impact of CVE-2021-45046 now includes - besides denial of
service - also information disclosure and local (and potential remote)
code execution. Siemens is currently investigating to determine
which products are affected and is continuously updating this advisory
as more information becomes available. See section Additional
Information for more details regarding the investigation status.
Note: two additional vulnerabilities were published for Apache Log4j,
the impact of which are documented in SSA-501673: https://cert-
portal.siemens.com/productcert/pdf/ssa-501673.pdf (CVE-2021-45105)
and SSA-784507: https://cert-
portal.siemens.com/productcert/pdf/ssa-784507.pdf (CVE-2021-44832).

Vulnerabilities 2

  • Critical 10.0
    CVE-2021-44228 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints

    Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …

    Apache Software Foundation Apache Log4j2 apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV Dec 10, 2021
  • Critical 9.0
    CVE-2021-45046 Exploited · Ransomware Public exploit Scanner template EPSS 100%

    Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

    It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…

    Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
    KEV May 1, 2023

Revision history

  1. #21

    Updated fix information for COMOS and Desigo CC V5.1

  2. #20

    Added fix for Opcenter Intelligence, Simcenter Amesim and Simcenter System Architect and for all affected version lines of Teamcenter product suite

  3. #19

    Added solution for Capital, COMOS, HES UDIS, Simcenter System Simulation Client for Git, Solid Edge CAM Pro, Solid Edge Wiring and Harness Design, VeSys; updated solution for SIMATIC IPC and SiPass V2.85; EnergyIP Prepay: clarified that fix release V3.8.0.12 is also valid for versions before V3.8

  4. #18

    Added solution for NX; confirmed that SIMATIC IT Report Manager is not affected; removed section "Products Under Investigation"

  5. #17

    Added or updated solutions for Siveillance Command, Control Pro, Vantage; added solution for Tecnomatix Plant Simulation (installations with TCCS)

  6. #16

    Added solution for Spectrum Power 4 and 7 (incl. jROS), for Teamcenter Technical Publishing and for Xpedition Enterprise and IC Packaging, versions VX.2.7, VX.2.8, VX.2.10; added additional products considered as not affected

  7. #15

    Added solutions for Teamcenter Active Workspace (AW), Microservices Framework (MSF) and Reporting and Analytics (TcRA); removed Teamcenter Requirements Integrator because it is not affected; added additional products considered as not affected

  8. #14

    Added solution for SiPass integrated, for Industrial Edge Management OS and App, and for Tecnomatix eBOP Manager Server V16.0.1, V16.1.1, V16.1.2; clarified the impact to cRSP and cRSP Operator Client Starter; added additional products considered as not affected

  9. #13

    Added solution for Simcenter 3D, and for Tecnomatix eBOP Manager Server V15.0, V16.0.2; added cRSP Operator Client Starter as under investigation; added a note regarding Enlighted Manage

  10. #12

    Added SIMATIC IPCs with Adaptec RAID; added additional Tecnomatix products (Process Designer, Process Simulate, RobotExpert, eBOP Manager Server); added reference to new SSA-784507 that covers a new Log4j vulnerability (CVE-2021-44832)

  11. #11

    Added solution for Xpedition Enterprise and IC Packaging; updated information for Geolus Shape Search; added SIMATIC IPCs as under investigation; added additional products considered as not affected

  12. #10

    Added solution for MindSphere Predictive Learning, GMA-Manager, Operation Scheduler, and Siveillance Identity; added SIMATIC IT Report Manager, Simcenter System Simulation Client for Git, Tecnomatix Intosite, Tecnomatix Plant Simulation, and Valor Parts Library; added additional products considered as not affected; updated section "Workarounds and Mitigations"

  13. #9

    Added Simcenter Testlab and Teamcenter Integration for CATIA; added additional products considered as not affected

  14. #8

    Added solution for MindSphere Visual Explorer; added jROS for Spectrum Power, Building Twin - 360° Viewer, and NXpower Monitor; added additional products considered as not affected

  15. #7

    Added non-exhaustive list of Siemens products currently not considered as affected; updated information for Industrial Edge Management OS and for SENTRON powermanager; updated impact, mitigation measures and fix release information for EnergyIP Prepay; added remediation for SIGUARD DSA; clarified Building Operator Discovery Applications vs. Connect X200/X300 gateways; added remediation for Advantage Navigator Software Proxy V6; added Advantage Navigator Software Proxy V5 to list of not affected products

  16. #6

    Added reference to new SSA-501673 that covers a new Log4j vulnerability (CVE-2021-45105); added remediation for SENTRON powermanager V4; added Connect X200/X300 gateways

  17. #5

    Revised severity of CVE-2021-45046 and removed ineffective mitigation measures; added Comfy and Enlighted; added individual Mindsphere applications; removed Siveillance Viewpoint because it is not affected; added a statement regarding Siemens Mobility solutions

  18. #4

    Added additional affected products, remediation or mitigation measures, and products under investigation; removed LOGO! Soft Comfort because it is not affected; expanded Teamcenter Suite to individual affected applications in Teamcenter; updated information for Desigo CC and Cerberus DMS

  19. #3

    Added additional affected products, remediation or mitigation measures, and products under investigation; removed SIMATIC WinCC V7.4 because it is not affected

  20. #2

    Added additional (potentially) affected products and additional remediation or mitigation measures; added reference to CVE-2021-45046 and updated mitigations accordingly

  21. #1

    Publication Date

References