PT-2017-17383 · Siemens · Simatic Cp 44X-1 Rna

Publicado 2017-07-07 · Atualizado 2017-12-30 · CVE-2017-6868

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Siemens SIMATIC CP 44x-1 RNA versions prior to 1.4.1

Description An issue with improper authentication was found, allowing an unauthenticated remote attacker to perform administrative actions on the Communication Process of the RNA series module. This is possible if network access to Port 102/TCP is available and the configuration file for the CP is stored on the RNA's CPU.

Recommendations For versions prior to 1.4.1, update to version 1.4.1 or later to resolve the issue. As a temporary workaround, consider restricting network access to Port 102/TCP and ensuring the configuration file for the CP is not stored on the RNA's CPU to minimize the risk of exploitation.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-6868

Produtos afetados

Simatic Cp 44X-1 Rna

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-6868 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-17-173-01 · Nota
• http://securityfocus.com/bid/99234 · Nota
• https://osv.dev/vulnerability/CVE-2017-6868 · Aviso do Fabricante
• http://securitytracker.com/id/1038788 · Nota
• https://siemens.com/cert/pool/cert/siemens_security_advisory_ssa-126840.pdf · Nota