PT-2021-11517 · Siemens · Simatic S7-1500 Software Controller+6

Published 2021-08-10 · Updated 2021-12-10 · CVE-2020-28397

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: SIMATIC Drive Controller family versions prior to V2.9.2 SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) versions prior to V21.9 SIMATIC S7 PLCSIM Advanced versions prior to V4 SIMATIC S7-1200 CPU family (incl. SIPLUS variants) version V4.4 SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) versions prior to V2.9.2 SIMATIC S7-1500 Software Controller versions prior to V21.9 TIM 1531 IRC (incl. SIPLUS NET variants) version V2.1

Description: A vulnerability has been identified due to an incorrect authorization check in the affected component. This allows an attacker to extract information about access protected PLC program variables over port 102/tcp from an affected device when reading multiple attributes at once.

Recommendations: For SIMATIC Drive Controller family versions prior to V2.9.2, update to version V2.9.2 or later. For SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) versions prior to V21.9, update to version V21.9 or later. For SIMATIC S7 PLCSIM Advanced versions prior to V4, update to version V4 or later. For SIMATIC S7-1200 CPU family (incl. SIPLUS variants) version V4.4, consider disabling access to port 102/tcp until a patch is available. For SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) versions prior to V2.9.2, update to version V2.9.2 or later. For SIMATIC S7-1500 Software Controller versions prior to V21.9, update to version V21.9 or later. For TIM 1531 IRC (incl. SIPLUS NET variants) version V2.1, consider restricting access to the affected component until a patch is available.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2020-28397

Affected Products

Simatic Drive Controller

Simatic Et 200Sp Open Controller

Simatic S7-Plcsim Advanced

Simatic S7-1200 Cpu

Simatic S7-1500 Cpu

Simatic S7-1500 Software Controller

Tim 1531 Irc

References · 4

• https://cert-portal.siemens.com/productcert/pdf/ssa-865327.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-28397 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28397 · Security Note
• https://t.me/cibsecurity/27044 · Telegram Post