PT-2022-4093 · Siemens · Simatic Pcs 7+1

Published 2022-02-09 · Updated 2022-10-06 · CVE-2021-40363

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SIMATIC PCS 7 versions V8.2 through V9.1 SIMATIC WinCC versions V7.4 through V7.5 SIMATIC WinCC versions V15 through V17

Description The issue is related to a potential information leak about files and directories. An attacker may exploit this to obtain credentials. The affected component stores local system account credentials in a project file using an outdated cipher algorithm, which could allow an attacker to brute force the credentials and take over the system.

Recommendations For SIMATIC PCS 7 versions V8.2 through V9.1, update to a version that includes the necessary security patches. For SIMATIC WinCC versions V7.4 through V7.5, update to V7.4 SP1 Update 19 or V7.5 SP2 Update 6, or later. For SIMATIC WinCC versions V15 through V17, update to V15 SP1 Update 7, V16 Update 5, or V17 Update 2, or later, and ensure that the update includes the fix for the outdated cipher algorithm used for storing credentials.

Fix

Cleartext Storage of Sensitive Information

Inadequate Encryption Strength

Weakness Enumeration

CWE-312

CWE-326

CWE-538

Related Identifiers

BDU:2022-04927

CVE-2021-40363

Affected Products

Simatic Pcs 7

Simatic Wincc

References · 4

• https://osv.dev/vulnerability/CVE-2021-40363 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-40363 · Security Note
• https://cert-portal.siemens.com/productcert/pdf/ssa-914168.pdf · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04927 · Security Note