PT-2019-2108 · Siemens · Simatic Hmi Classic Devices+6

Publicado 2019-05-14 · Atualizado 2019-05-22 · CVE-2019-6577

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15.1 Update 1 SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15.1 Update 1 SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900, and KTP900F versions prior to V15.1 Update 1 SIMATIC WinCC Runtime Advanced versions prior to V15.1 Update 1 SIMATIC WinCC Runtime Professional versions prior to V15.1 Update 1 SIMATIC WinCC (TIA Portal) versions prior to V15.1 Update 1 SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel) (affected versions not specified)

Description The integrated web server in the affected devices could allow Cross-Site Scripting (XSS) attacks if an attacker is able to modify particular parts of the device configuration via SNMP. The issue could be exploited by an attacker with network access to the affected system, requiring system privileges and user interaction. Successful exploitation could compromise confidentiality and the integrity of the affected system. No public exploitation is known at the time of publishing this security advisory.

Recommendations For SIMATIC HMI Comfort Panels 4" - 22" versions prior to V15.1 Update 1, update to V15.1 Update 1 or later. For SIMATIC HMI Comfort Outdoor Panels 7" & 15" versions prior to V15.1 Update 1, update to V15.1 Update 1 or later. For SIMATIC HMI KTP Mobile Panels KTP400F, KTP700, KTP700F, KTP900, and KTP900F versions prior to V15.1 Update 1, update to V15.1 Update 1 or later. For SIMATIC WinCC Runtime Advanced versions prior to V15.1 Update 1, update to V15.1 Update 1 or later. For SIMATIC WinCC Runtime Professional versions prior to V15.1 Update 1, update to V15.1 Update 1 or later. For SIMATIC WinCC (TIA Portal) versions prior to V15.1 Update 1, update to V15.1 Update 1 or later. For SIMATIC HMI Classic Devices (TP/MP/OP/MP Mobile Panel), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-80

CWE-79

Identificadores relacionados

BDU:2019-01864

CVE-2019-6577

Produtos afetados

Simatic Hmi Classic Devices

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc

Simatic Wincc Runtime Advanced

Simatic Wincc Runtime Professional

Referências · 7

• http://securityfocus.com/bid/108412 · Nota
• https://osv.dev/vulnerability/CVE-2019-6577 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01864 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-6577 · Nota de Segurança
• https://us-cert.gov/ics/advisories/ICSA-19-134-09 · Nota
• https://cert-portal.siemens.com/productcert/pdf/ssa-804486.pdf · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6572 · Nota de Segurança