PT-2015-7745 · Siemens · Simatic Cp 343-1 Advanced+12

Publicado 2015-11-27 · Atualizado 2021-04-22 · CVE-2015-8214

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC NET CP 342-5 versions prior to not specified SIMATIC NET CP 343-1 Advanced versions prior to V3.0.44 SIMATIC NET CP 343-1 Lean versions prior to V3.1.1 SIMATIC NET CP 343-1 Standard versions prior to V3.1.1 SIMATIC NET CP 443-1 Advanced versions prior to V3.2.9 SIMATIC NET CP 443-1 Standard versions prior to V3.2.9 SIMATIC NET CP 443-5 Basic versions prior to not specified SIMATIC NET CP 443-5 Extended versions prior to not specified TIM 3V-IE / TIM 3V-IE Advanced versions prior to V2.6.0 TIM 3V-IE DNP3 versions prior to V3.1.0 TIM 4R-IE versions prior to V2.6.0 TIM 4R-IE DNP3 versions prior to V3.1.0

Description The issue concerns the access protection level enforcement in certain communication processors, which could allow unauthenticated users to perform administrative operations if network access is available and the configuration was stored on the corresponding CPUs. This could potentially be exploited via network access on port 102/TCP.

Recommendations For SIMATIC NET CP 342-5, update to a version that fixes this issue, as the current version is not specified. For SIMATIC NET CP 343-1 Advanced, update to version V3.0.44 or later. For SIMATIC NET CP 343-1 Lean, update to version V3.1.1 or later. For SIMATIC NET CP 343-1 Standard, update to version V3.1.1 or later. For SIMATIC NET CP 443-1 Advanced, update to version V3.2.9 or later. For SIMATIC NET CP 443-1 Standard, update to version V3.2.9 or later. For SIMATIC NET CP 443-5 Basic, update to a version that fixes this issue, as the current version is not specified. For SIMATIC NET CP 443-5 Extended, update to a version that fixes this issue, as the current version is not specified. For TIM 3V-IE / TIM 3V-IE Advanced, update to version V2.6.0 or later. For TIM 3V-IE DNP3, update to version V3.1.0 or later. For TIM 4R-IE, update to version V2.6.0 or later. For TIM 4R-IE DNP3, update to version V3.1.0 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2015-8214

Produtos afetados

Simatic Net Cp 342-5

Simatic Cp 343-1 Advanced

Simatic Cp 343-1 Lean

Simatic Net Cp 343-1 Standard

Simatic Cp 443-1 Advanced

Simatic Net Cp 443-1 Standard

Simatic Net Cp 443-5 Basic

Simatic Net Cp 443-5 Extended

Tim 3V-Ie

Tim 3V-Ie Advanced

Tim 3V-Ie Dnp3

Tim 4R-Ie

Tim 4R-Ie Dnp3

Referências · 5

• http://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-763427.pdf · Aviso do Fabricante
• http://securityfocus.com/bid/78345 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-763427.pdf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8214 · Nota de Segurança
• http://securitytracker.com/id/1034279 · Nota