Description
A vulnerability has been identified in SIMATIC HMI Comfort Panels (incl. SIPLUS variants) (All versions < V17 Update 4), SIMATIC HMI KTP Mobile Panels (All versions < V17 Update 4), SIMATIC HMI KTP1200 Basic (All versions < V17 Update 5), SIMATIC HMI KTP400 Basic (All versions < V17 Update 5), SIMATIC HMI KTP700 Basic (All versions < V17 Update 5), SIMATIC HMI KTP900 Basic (All versions < V17 Update 5), SIPLUS HMI KTP1200 BASIC (All versions < V17 Update 5), SIPLUS HMI KTP400 BASIC (All versions < V17 Update 5), SIPLUS HMI KTP700 BASIC (All versions < V17 Update 5), SIPLUS HMI KTP900 BASIC (All versions < V17 Update 5). Affected devices do not properly validate input sent to certain services over TCP. This could allow an unauthenticated remote attacker to cause a permanent denial of service condition (requiring a device reboot) by sending specially crafted TCP packets.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | SIMATIC HMI Comfort Panels (incl. SIPLUS variants) | All versions < V17 Update 4 | — |
| Siemens | SIMATIC HMI KTP Mobile Panels | All versions < V17 Update 4 | — |
| Siemens | SIMATIC HMI KTP1200 Basic | All versions < V17 Update 5 | — |
| Siemens | SIMATIC HMI KTP400 Basic | All versions < V17 Update 5 | — |
| Siemens | SIMATIC HMI KTP700 Basic | All versions < V17 Update 5 | — |
| Siemens | SIMATIC HMI KTP900 Basic | All versions < V17 Update 5 | — |
| Siemens | SIPLUS HMI KTP1200 BASIC | All versions < V17 Update 5 | — |
| Siemens | SIPLUS HMI KTP400 BASIC | All versions < V17 Update 5 | — |
| Siemens | SIPLUS HMI KTP700 BASIC | All versions < V17 Update 5 | — |
| Siemens | SIPLUS HMI KTP900 BASIC | All versions < V17 Update 5 | — |
Advisories 2
- ICSA-22-286-14 Siemens SIMATIC HMI Panels CISA ICS & IT advisories · Oct 11, 2022
- SSA-384224 SSA-384224: Denial of Service Vulnerability in SIMATIC HMI Panels Siemens ProductCERT · Oct 11, 2022