PT-2021-7540 · Siemens · Simatic Hmi Comfort Outdoor Panels+8

Published 2021-05-11 · Updated 2021-12-16 · CVE-2021-27384

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Outdoor Panels versions prior to V15.1 Update 6 SIMATIC HMI Comfort Outdoor Panels versions prior to V16 Update 4 SIMATIC HMI Comfort Panels versions prior to V15.1 Update 6 SIMATIC HMI Comfort Panels versions prior to V16 Update 4 SIMATIC HMI KTP Mobile Panels versions prior to V15.1 Update 6 SIMATIC HMI KTP Mobile Panels versions prior to V16 Update 4 SIMATIC WinCC Runtime Advanced versions prior to V15.1 Update 6 SIMATIC WinCC Runtime Advanced versions prior to V16 Update 4 SINAMICS GH150 (all versions) SINAMICS GL150 (with option X30) (all versions) SINAMICS GM150 (with option X30) (all versions) SINAMICS SH150 (all versions) SINAMICS SL150 (all versions) SINAMICS SM120 (all versions) SINAMICS SM150 (all versions) SINAMICS SM150i (all versions)

Description The issue is caused by an out-of-bounds memory access vulnerability in the device layout handler, which can potentially result in code execution. This vulnerability affects various Siemens products, including SIMATIC and SINAMICS. The vulnerability can be exploited by a remote attacker, allowing them to execute arbitrary code.

Recommendations For SIMATIC HMI Comfort Outdoor Panels versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC HMI Comfort Outdoor Panels versions prior to V16 Update 4, update to V16 Update 4 or later. For SIMATIC HMI Comfort Panels versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC HMI Comfort Panels versions prior to V16 Update 4, update to V16 Update 4 or later. For SIMATIC HMI KTP Mobile Panels versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC HMI KTP Mobile Panels versions prior to V16 Update 4, update to V16 Update 4 or later. For SIMATIC WinCC Runtime Advanced versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC WinCC Runtime Advanced versions prior to V16 Update 4, update to V16 Update 4 or later. For SINAMICS products, contact the vendor for specific guidance on mitigation or resolution, as all versions are affected.

Fix

Access of Memory Location After End of Buffer

Weakness Enumeration

CWE-788

Related Identifiers

BDU:2022-07424

CVE-2021-27384

Affected Products

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc Runtime Advanced

Sinamics Gh150

Sinamics Sl150

Sinamics Sm150

Sinamics Sm120

Sinamics Sm150I

References · 8

• https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27384 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27384 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07424 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-21-131-12 · Note
• https://t.me/cvenotify/14801 · Telegram Post
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-11 · Note