Summary
Multiple vulnerabilities (also known as "NUCLEUS:13") have been identified in the Nucleus RTOS (real-time operating system) and reported in the Siemens Security Advisory SSA-044112: https://cert-portal.siemens.com/productcert/pdf/ssa-044112.pdf.
PLUSCONTROL 1st Gen devices are affected by some of the vulnerabilities as documented below.
Siemens Energy recommends specific countermeasures for products where updates are not available.
Vulnerabilities 6
-
High 8.2
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
High 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
High 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
High 7.5
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
Medium 5.3
A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic …
-
Unscored —
A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All ve…
Revision history
-
#1
Publication Date
References
-
SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-845392.pdf
-
SSA-845392: Multiple Vulnerabilities in Nucleus RTOS based Siemens Energy PLUSCONTROL 1st Gen Devices - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-845392.txt