PT-2021-7833 · Siemens · Simatic Hmi Comfort Outdoor Panels+8

Published 2021-05-11 · Updated 2022-01-04 · CVE-2021-27386

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SIMATIC HMI Comfort Outdoor Panels versions prior to V15.1 Update 6 SIMATIC HMI Comfort Outdoor Panels versions prior to V16 Update 4 SIMATIC HMI Comfort Panels versions prior to V15.1 Update 6 SIMATIC HMI Comfort Panels versions prior to V16 Update 4 SIMATIC HMI KTP Mobile Panels versions prior to V15.1 Update 6 SIMATIC HMI KTP Mobile Panels versions prior to V16 Update 4 SIMATIC WinCC Runtime Advanced versions prior to V15.1 Update 6 SIMATIC WinCC Runtime Advanced versions prior to V16 Update 4 SINAMICS GH150 (all versions) SINAMICS GL150 (with option X30) (all versions) SINAMICS GM150 (with option X30) (all versions) SINAMICS SH150 (all versions) SINAMICS SL150 (all versions) SINAMICS SM120 (all versions) SINAMICS SM150 (all versions) SINAMICS SM150i (all versions)

Description The issue is related to a heap allocation leak vulnerability in the device layout handler on the client side, which could result in a Denial-of-Service condition. This vulnerability is associated with an error in memory release. Exploitation of the vulnerability may allow a remote attacker to cause a denial of service.

Recommendations For SIMATIC HMI Comfort Outdoor Panels versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC HMI Comfort Outdoor Panels versions prior to V16 Update 4, update to V16 Update 4 or later. For SIMATIC HMI Comfort Panels versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC HMI Comfort Panels versions prior to V16 Update 4, update to V16 Update 4 or later. For SIMATIC HMI KTP Mobile Panels versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC HMI KTP Mobile Panels versions prior to V16 Update 4, update to V16 Update 4 or later. For SIMATIC WinCC Runtime Advanced versions prior to V15.1 Update 6, update to V15.1 Update 6 or later. For SIMATIC WinCC Runtime Advanced versions prior to V16 Update 4, update to V16 Update 4 or later. For SINAMICS products (GH150, GL150 with option X30, GM150 with option X30, SH150, SL150, SM120, SM150, SM150i), at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Leak

Weakness Enumeration

CWE-401

Related Identifiers

BDU:2023-03468

CVE-2021-27386

Affected Products

Simatic Hmi Comfort Outdoor Panels

Simatic Hmi Comfort Panels

Simatic Hmi Ktp Mobile Panels

Simatic Wincc Runtime Advanced

Sinamics Gh150

Sinamics Sl150

Sinamics Sm150

Sinamics Sm120

Sinamics Sm150I

References · 7

• https://bdu.fstec.ru/vul/2023-03468 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-286838.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27386 · Vendor Advisory
• https://cert-portal.siemens.com/productcert/pdf/ssa-538778.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27386 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-131-12 · Note
• https://vuldb.com/?id.174983 · Note