Summary
Security researchers discovered and disclosed 14 vulnerabilities in the Interniche IP stack, also known as "INFRA:HALT" vulnerabilities [0]. This advisory describes the impact to Siemens low voltage products, which are only affected by four out of the 14 vulnerabilities.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
Vulnerabilities 4
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that parses ICMP packets relies on an unchecked value of the IP…
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that parses TCP packets relies on an unchecked value of the IP …
-
Unscored —
An issue was discovered in HCC Nichestack 3.0. The code that generates Initial Sequence Numbers (ISNs) for TCP connecti…
-
Unscored —
An issue was discovered in tcp_rcv() in nptcp.c in HCC embedded InterNiche 4.0.1. The TCP header processing code doesn'…
Revision history
-
#3
Added solution for SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module (7KM9300-0AE01-0AA0)
-
#2
Split SENTRON 7KM PAC Switched Ethernet PROFINET Expansion Module into three products (MLFBs); updated link to solution for SENTRON 3WA COM190
-
#1
Publication Date
References
-
SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-789208.pdf
-
SSA-789208: Multiple Vulnerabilities (INFRA:HALT) in Interniche IP-Stack based Low Voltage Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-789208.txt