Summary
SIMATIC CM 1542-1, SCALANCE SC600 family and SIMATIC CP 343-1 Advanced devices are vulnerable to a vulnerability in the third party component libcurl that could allow an attacker to cause a Denial-of-Service condition on the affected devices.
Siemens has released updates for several affected products and recommends to update to the latest versions. Siemens recommends specific countermeasures for products where updates are not, or not yet available.
The impact of additional libcurl vulnerabilities is described in Siemens Security Advisory SSA-436177.
Vulnerabilities 1
-
Medium 4.3
libcurl versions from 7.34.0 to before 7.64.0 are vulnerable to a heap out-of-bounds read in the code handling the end-…
Revision history
-
#3
Added solution for SIMATIC CM 1542-1
-
#2
Added SIMATIC CP 343-1 Advanced (incl. SIPLUS variants) to the list of affected products
-
#1
Publication Date
References
-
SSA-936080: Multiple Vulnerabilities in Third-Party Component libcurl - PDF Version
https://cert-portal.siemens.com/productcert/pdf/ssa-936080.pdf
-
SSA-936080: Multiple Vulnerabilities in Third-Party Component libcurl - TXT Version
https://cert-portal.siemens.com/productcert/txt/ssa-936080.txt