PT-2019-4788 · Siemens · Simatic S7-300

Published 2019-01-08 · Updated 2019-10-03 · CVE-2018-16561

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC S7-300 CPUs versions prior to V3.X.16

Description A vulnerability has been identified that improperly validates S7 communication packets, potentially causing a Denial-of-Service condition of the CPU. The CPU will remain in DEFECT mode until manual restart. Successful exploitation requires an attacker to send a specially crafted S7 communication packet to a communication interface of the CPU, including Ethernet, PROFIBUS, and Multi Point Interfaces (MPI). No user interaction or privileges are required to exploit the security issue. This could allow causing a Denial-of-Service condition of the core functionality of the CPU, compromising the availability of the system.

Recommendations For versions prior to V3.X.16, update to a version V3.X.16 or later to resolve the security issue. As a temporary workaround, consider restricting access to the communication interfaces, including Ethernet, PROFIBUS, and Multi Point Interfaces (MPI), to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-01366

CVE-2018-16561

Affected Products

Simatic S7-300

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-16561 · Security Note
• https://bdu.fstec.ru/vul/2020-01366 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-306710.pdf · Vendor Advisory
• https://us-cert.gov/ics/advisories/ICSA-19-043-04 · Note