PT-2019-3865 · Siemens+1 · Simatic Pcs 7+5

Published 2019-07-09 · Updated 2019-10-10 · CVE-2019-10935

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC PCS 7 versions V8.0 and earlier SIMATIC PCS 7 version V8.1 through V8.1 with WinCC V7.3 Upd 18 SIMATIC PCS 7 version V8.2 through V8.2 SP1 with WinCC V7.4 SP1 Upd 10 SIMATIC PCS 7 version V9.0 through V9.0 SP2 with WinCC V7.4 SP1 Upd 10 SIMATIC WinCC Professional (TIA Portal V13) version SIMATIC WinCC Professional (TIA Portal V14) version through V14 SP1 Upd 8 SIMATIC WinCC Professional (TIA Portal V15) version through V15.1 Upd 2 SIMATIC WinCC Runtime Professional V13 version SIMATIC WinCC Runtime Professional V14 version through V14.1 Upd 7 SIMATIC WinCC Runtime Professional V15 version through V15.1 Upd 2 SIMATIC WinCC version V7.2 and earlier SIMATIC WinCC version V7.3 through V7.3 Upd 18 SIMATIC WinCC version V7.4 through V7.4 SP1 Upd 10 SIMATIC WinCC version V7.5 through V7.5 Upd 2

Description The SIMATIC WinCC DataMonitor web application of the affected products allows an attacker to upload arbitrary ASPX code due to insufficient input validation. This issue can be exploited by an authenticated attacker with network access to the WinCC DataMonitor application, and no user interaction is required. The vulnerability impacts the confidentiality, integrity, and availability of the affected device. At the time of publishing, no public exploitation of this issue is known.

Recommendations For SIMATIC PCS 7 versions V8.0 and earlier, update to a version later than V8.0. For SIMATIC PCS 7 version V8.1 through V8.1 with WinCC V7.3 Upd 18, update to V8.1 with WinCC V7.3 Upd 19 or later. For SIMATIC PCS 7 version V8.2 through V8.2 SP1 with WinCC V7.4 SP1 Upd 10, update to V8.2 SP1 with WinCC V7.4 SP1 Upd 11 or later. For SIMATIC PCS 7 version V9.0 through V9.0 SP2 with WinCC V7.4 SP1 Upd 10, update to V9.0 SP2 with WinCC V7.4 SP1 Upd 11 or later. For SIMATIC WinCC Professional (TIA Portal V13) version , consider disabling the SIMATIC WinCC DataMonitor web application until a patch is available. For SIMATIC WinCC Professional (TIA Portal V14) version through V14 SP1 Upd 8, update to V14 SP1 Upd 9 or later. For SIMATIC WinCC Professional (TIA Portal V15) version through V15.1 Upd 2, update to V15.1 Upd 3 or later. For SIMATIC WinCC Runtime Professional V13 version , consider disabling the SIMATIC WinCC DataMonitor web application until a patch is available. For SIMATIC WinCC Runtime Professional V14 version through V14.1 Upd 7, update to V14.1 Upd 8 or later. For SIMATIC WinCC Runtime Professional V15 version through V15.1 Upd 2, update to V15.1 Upd 3 or later. For SIMATIC WinCC version V7.2 and earlier, update to a version later than V7.2. For SIMATIC WinCC version V7.3 through V7.3 Upd 18, update to V7.3 Upd 19 or later. For SIMATIC WinCC version V7.4 through V7.4 SP1 Upd 10, update to V7.4 SP1 Upd 11 or later. For SIMATIC WinCC version V7.5 through V7.5 Upd 2, update to V7.5 Upd 3 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2019-04229

CVE-2019-10935

Affected Products

Aspx

Simatic Pcs 7

Simatic Wincc

Simatic Wincc Professional

Simatic Wincc Runtime Professional

Tia Portal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-10935 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10935 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-121293.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04229 · Security Note