PT-2019-2105 · Siemens · Simatic Wincc+1
Publicado
2019-05-14
·
Atualizado
2020-10-02
·
CVE-2019-10922
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
SIMATIC PCS 7 versions 8.0 and earlier
SIMATIC PCS 7 versions 8.1 and newer
SIMATIC WinCC versions 7.2 and earlier
SIMATIC WinCC versions 7.3 and newer
Description
A security issue has been identified that allows an attacker with network access to execute arbitrary code on affected installations configured without "Encrypted Communication". This can be exploited by an unauthenticated attacker with no user interaction required, impacting the confidentiality, integrity, and availability of the device. At the time of publication, no public exploitation of this issue was known.
Recommendations
For SIMATIC PCS 7 versions 8.0 and earlier, consider enabling "Encrypted Communication" to mitigate the risk.
For SIMATIC PCS 7 versions 8.1 and newer, consider enabling "Encrypted Communication" to mitigate the risk.
For SIMATIC WinCC versions 7.2 and earlier, consider enabling "Encrypted Communication" to mitigate the risk.
For SIMATIC WinCC versions 7.3 and newer, consider enabling "Encrypted Communication" to mitigate the risk.
As a temporary workaround, consider restricting network access to affected installations until a fix is available.
Correção
Missing Authentication
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Simatic Pcs 7
Simatic Wincc