Siemens SIMATIC S7-1200 and S7-1500 CPU Families

1. EXECUTIVE SUMMARY

• CVSS v3 9.3
• ATTENTION: Low attack complexity
• Vendor: Siemens
• Equipment: SIMATIC S7-1200 and S7-1500 CPU families
• Vulnerability: Insufficiently Protected Credentials

2. RISK EVALUATION

Successful exploitation of this vulnerability could expose confidential configuration data.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports this vulnerability affects the SIMATIC S7-1200 and S7-1500 CPU product families:

• SIMATIC Drive Controller family: All versions prior to 2.9.2
• SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (including SIPLUS variants): All versions prior to 21.9
• SIMATIC ET 200SP Open controller CPU 1515SP PC (including SIPLUS variants): All versions
• SIMATIC S7-1200 CPU family (including SIPLUS variants): All versions prior to V4.5.0
• SIMATIC S7-1500 CPU family (including related ET200 CPUs and SIPLUS variants): All versions prior to 2.9.2
• SIMATIC S7-1500 Software Controller: All version prior to 21.9
• SIMCATIC S7-PLCSIM Advanced: All version prior to 4.0

3.2 VULNERABILITY OVERVIEW

3.2.1    INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522

Affected Siemens SIMATIC S7-1200 and S7-1500 CPU Families protect the built-in global private key with insufficient key protection. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and human machine interface (HMI) communication.

CVE-2022-38465 has been assigned to this vulnerability. A CVSS v3 base score of 9.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Multiple Sectors
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Tal Keren from Claroty reported this vulnerability to Siemens.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations that users can apply to reduce the risk:

• For SIMATIC Drive Controller family: Update to version 2.9.2 or later, migrate project in TIA Portal to the updated version and redeploy within the project, configure the CPU to “Only allow PG/PC and HMI communication”.
• For SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (including SIPLUS variants): Update to version 21.9 or later and redeploy within the project, configure the CPU to “Only allow PG/PC and HMI communication”.
• For SIMATIC ET 200SP Open controller CPU 1515SP PC (including SIPLUS variants): Currently no fix is planned.
• For SIMATIC S7-1200 CPU family (including SIPLUS variants): Update to version 4.5.0 or later and redeploy within the project, configure the CPU to “Only allow PG/PC and HMI communication”.
• For SIMATIC S7-1500 CPU family (including related ET200 CPUs and SIPLUS variants): Update to version 2.9.2 or later and redeploy within the project, configure the CPU to “Only allow PG/PC and HMI communication”.
• For SIMATIC S7-1500 Software Controller: Update to version 21.9 or later version and redeploy within the project, configure the CPU to “Only allow PG/PC and HMI communication”.
• For SIMCATIC S7-PLCSIM Advanced: Update to version 4.0 or later and redeploy within the project, configure the CPU to “Only allow PG/PC and HMI communication

Siemens has identified additional workarounds and mitigations users can apply to reduce risk:

• Only use legacy, not TLS-based, PG/PC and HMI communication in trusted network environments.
• Protect access to the TIA Portal project and CPU, including related memory cards, from unauthorized persons.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security, and following the recommendations in the product manuals.

Siemens has provided additional information on industrial security.

For more information, see Siemens Security Advisory SSA-568427 in HTML or CSAF.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability. This vulnerability is not exploitable remotely.

• Siemens