PT-2018-2483 · Siemens · Simatic S7-1500 Incl. F+2

Publicado 2018-10-09 · Atualizado 2019-03-21 · CVE-2018-13805

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC ET 200SP Open Controller versions 2.0 through 2.1.5 SIMATIC S7-1500 Software Controller versions 2.0 through 2.4 SIMATIC S7-1500 incl. F versions 2.0 through 2.4

Description A vulnerability has been identified that allows an attacker to cause a denial-of-service condition on the network stack by sending a large number of specially crafted packets to the PLC. This could lead to the PLC losing its ability to communicate over the network, compromising the availability of network connectivity. The vulnerability can be exploited by an attacker with network access to the affected systems, requiring no privileges and no user interaction. At the time of advisory publication, no public exploitation of this vulnerability was known.

Recommendations For SIMATIC ET 200SP Open Controller versions 2.0 through 2.1.5, update to version 2.1.6 or later. For SIMATIC S7-1500 Software Controller versions 2.0 through 2.4, update to version 2.5 or later. For SIMATIC S7-1500 incl. F versions 2.0 through 2.4, update to version 2.5 or later.

Correção

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

BDU:2019-00767

CVE-2018-13805

Produtos afetados

Simatic Et 200Sp Open Controller

Simatic S7-1500 Software Controller

Simatic S7-1500 Incl. F

Referências · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-347726.pdf · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-13805 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00767 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-13805 · Nota de Segurança