PT-2021-17428 · Siemens · Simatic Hmi Comfort Outdoor Panels+8

Published 2021-05-12 · Updated 2021-12-16 · CVE-2021-27383

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants) versions prior to V15.1 Update 6 SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants) versions prior to V16 Update 4 SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants) versions prior to V15.1 Update 6 SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants) versions prior to V16 Update 4 SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V15.1 Update 6 SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F versions prior to V16 Update 4 SIMATIC WinCC Runtime Advanced V15 versions prior to V15.1 Update 6 SIMATIC WinCC Runtime Advanced V16 versions prior to V16 Update 4 SINAMICS GH150 versions prior to not specified SINAMICS GL150 (with option X30) versions prior to not specified SINAMICS GM150 (with option X30) versions prior to not specified SINAMICS SH150 versions prior to not specified SINAMICS SL150 versions prior to not specified SINAMICS SM120 versions prior to not specified SINAMICS SM150 versions prior to not specified SINAMICS SM150i versions prior to not specified

Description A heap allocation leak vulnerability has been identified in the server Tight encoder of SmartVNC, which could result in a Denial-of-Service condition. This issue affects various SIMATIC HMI and WinCC products, as well as SINAMICS devices.

Recommendations For SIMATIC HMI Comfort Outdoor Panels V15 7" & 15" (incl. SIPLUS variants), update to version V15.1 Update 6 or later. For SIMATIC HMI Comfort Outdoor Panels V16 7" & 15" (incl. SIPLUS variants), update to version V16 Update 4 or later. For SIMATIC HMI Comfort Panels V15 4" - 22" (incl. SIPLUS variants), update to version V15.1 Update 6 or later. For SIMATIC HMI Comfort Panels V16 4" - 22" (incl. SIPLUS variants), update to version V16 Update 4 or later. For SIMATIC HMI KTP Mobile Panels V15 KTP400F, KTP700, KTP700F, KTP900 and KTP900F, update to version V15.1 Update 6 or later. For SIMATIC HMI KTP Mobile Panels V16 KTP400F, KTP700, KTP700F, KTP900 and KTP900F, update to version V16 Update 4 or later. For SIMATIC WinCC Runtime Advanced V15, update to version V15.1 Update 6 or later. For SIMATIC WinCC Runtime Advanced V16, update to version V16 Update 4 or later. For SINAMICS devices, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2021-27383

Affected Products

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc Runtime Advanced

Sinamics Gh150

Sinamics Sl150

Sinamics Sm150

Sinamics Sm120

Sinamics Sm150I

References · 7

• https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27383 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf · Vendor Advisory
• https://t.me/cvenotify/14367 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12 · Note
• https://t.me/cvenotify/14798 · Telegram Post