Resource Allocation in Siemens RUGGEDCOM

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

1. EXECUTIVE SUMMARY

CVSS v3 7.5
ATTENTION: Exploitable remotely/low attack complexity
Vendor: Siemens
Equipment: RUGGEDCOM
Vulnerability: Allocation of Resources without Limits or Throttling

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an unauthorized attacker to cause total loss of availability in the affected devices’ web server.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following products from Siemens are affected:

RUGGEDCOM i800: All versions prior to V4.3.8
RUGGEDCOM i800NC: All versions prior to V4.3.8
RUGGEDCOM i801: All versions prior to V4.3.8
RUGGEDCOM i801NC: All versions prior to V4.3.8
RUGGEDCOM i802: All versions prior to V4.3.8
RUGGEDCOM i802NC: All versions prior to V4.3.8
RUGGEDCOM i803: All versions prior to V4.3.8
RUGGEDCOM i803NC: All versions prior to V4.3.8
RUGGEDCOM M2100: All versions prior to V4.3.8
RUGGEDCOM M2100F: All versions
RUGGEDCOM M2100NC: All versions prior to V4.3.8
RUGGEDCOM M2200: All versions prior to V4.3.8
RUGGEDCOM M2200F: All versions
RUGGEDCOM M2200NC: All versions prior to V4.3.8
RUGGEDCOM M969: All versions prior to V4.3.8
RUGGEDCOM M969F: All versions
RUGGEDCOM M969NC: All versions prior to V4.3.8
RUGGEDCOM RMC30: All versions prior to V4.3.8
RUGGEDCOM RMC30NC: All versions prior to V4.3.8
RUGGEDCOM RMC8388 V4.X: All versions prior to V4.3.8
RUGGEDCOM RMC8388 V5.X: All versions
RUGGEDCOM RMC8388NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RMC8388NC V5.X: All versions
RUGGEDCOM RP110: All versions prior to V4.3.8
RUGGEDCOM RP110NC: All versions prior to V4.3.8
RUGGEDCOM RS1600: All versions prior to V4.3.8
RUGGEDCOM RS1600F: All versions prior to V4.3.8
RUGGEDCOM RS1600FNC: All versions prior to V4.3.8
RUGGEDCOM RS1600NC: All versions prior to V4.3.8
RUGGEDCOM RS1600T: All versions prior to V4.3.8
RUGGEDCOM RS1600TNC: All versions prior to V4.3.8
RUGGEDCOM RS400: All versions prior to V4.3.8
RUGGEDCOM RS400F: All versions
RUGGEDCOM RS400NC: All versions prior to V4.3.8
RUGGEDCOM RS401: All versions prior to V4.3.8
RUGGEDCOM RS401NC: All versions prior to V4.3.8
RUGGEDCOM RS416: All versions prior to V4.3.8
RUGGEDCOM RS416F: All versions
RUGGEDCOM RS416NC: All versions prior to V4.3.8
RUGGEDCOM RS416NC v2: All versions
RUGGEDCOM RS416P: All versions prior to V4.3.8
RUGGEDCOM RS416PF: All versions
RUGGEDCOM RS416PNC: All versions prior to V4.3.8
RUGGEDCOM RS416PNC v2: All versions
RUGGEDCOM RS416Pv2: All versions
RUGGEDCOM RS416v2: All versions
RUGGEDCOM RS8000: All versions prior to V4.3.8
RUGGEDCOM RS8000A: All versions prior to V4.3.8
RUGGEDCOM RS8000ANC: All versions prior to V4.3.8
RUGGEDCOM RS8000H: All versions prior to V4.3.8
RUGGEDCOM RS8000HNC: All versions prior to V4.3.8
RUGGEDCOM RS8000NC: All versions prior to V4.3.8
RUGGEDCOM RS8000T: All versions prior to V4.3.8
RUGGEDCOM RS8000TNC: All versions prior to V4.3.8
RUGGEDCOM RS900: All versions prior to V4.3.8
RUGGEDCOM RS900 (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900 (32M) V5.X: All versions
RUGGEDCOM RS900F: All versions
RUGGEDCOM RS900G: All versions prior to V4.3.8
RUGGEDCOM RS900G (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900G (32M) V5.X: All versions
RUGGEDCOM RS900GF: All versions
RUGGEDCOM RS900GNC: All versions prior to V4.3.8
RUGGEDCOM RS900GNC(32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900GNC(32M) V5.X: All versions
RUGGEDCOM RS900GP: All versions prior to V4.3.8
RUGGEDCOM RS900GPF: All versions
RUGGEDCOM RS900GPNC: All versions prior to V4.3.8
RUGGEDCOM RS900L: All versions prior to V4.3.8
RUGGEDCOM RS900LNC: All versions prior to V4.3.8
RUGGEDCOM RS900M-GETS-C01: All versions prior to V4.3.8
RUGGEDCOM RS900M-GETS-XX: All versions prior to V4.3.8
RUGGEDCOM RS900M-STND-C01: All versions prior to V4.3.8
RUGGEDCOM RS900M-STND-XX: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-GETS-C01: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-GETS-XX: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-STND-XX: All versions prior to V4.3.8
RUGGEDCOM RS900MNC-STND-XX-C01: All versions prior to V4.3.8
RUGGEDCOM RS900NC: All versions prior to V4.3.8
RUGGEDCOM RS900NC (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RS900NC (32M) V5.X: All versions
RUGGEDCOM RS900W: All versions prior to V4.3.8
RUGGEDCOM RS910: All versions prior to V4.3.8
RUGGEDCOM RS910L: All versions prior to V4.3.8
RUGGEDCOM RS910LNC: All versions prior to V4.3.8
RUGGEDCOM RS910NC: All versions prior to V4.3.8
RUGGEDCOM RS910W: All versions prior to V4.3.8
RUGGEDCOM RS920L: All versions prior to V4.3.8
RUGGEDCOM RS920LNC: All versions prior to V4.3.8
RUGGEDCOM RS920W: All versions prior to V4.3.8
RUGGEDCOM RS930L: All versions prior to V4.3.8
RUGGEDCOM RS930LNC: All versions prior to V4.3.8
RUGGEDCOM RS930W: All versions prior to V4.3.8
RUGGEDCOM RS940G: All versions prior to V4.3.8
RUGGEDCOM RS940GF: All versions
RUGGEDCOM RS940GNC: All versions prior to V4.3.8
RUGGEDCOM RS969: All versions prior to V4.3.8
RUGGEDCOM RS969NC: All versions prior to V4.3.8
RUGGEDCOM RSG2100: All versions prior to V4.3.8
RUGGEDCOM RSG2100 (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2100 (32M) V5.X: All versions
RUGGEDCOM RSG2100F: All versions
RUGGEDCOM RSG2100NC: All versions prior to V4.3.8
RUGGEDCOM RSG2100NC (32M) V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2100NC (32M) V5.X: All versions
RUGGEDCOM RSG2100P: All versions prior to V4.3.8
RUGGEDCOM RSG2100PF: All versions
RUGGEDCOM RSG2100PNC: All versions prior to V4.3.8
RUGGEDCOM RSG2200: All versions prior to V4.3.8
RUGGEDCOM RSG2200F: All versions
RUGGEDCOM RSG2200NC: All versions prior to V4.3.8
RUGGEDCOM RSG2288 V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2288 V5.X: All versions
RUGGEDCOM RSG2288NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2288NC V5.X: All versions
RUGGEDCOM RSG2300 V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300 V5.X: All versions
RUGGEDCOM RSG2300F: All versions
RUGGEDCOM RSG2300NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300NC V5.X: All versions
RUGGEDCOM RSG2300P V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300P V5.X: All versions
RUGGEDCOM RSG2300PF: All versions
RUGGEDCOM RSG2300PNC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2300PNC V5.X: All versions
RUGGEDCOM RSG2488 V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2488 V5.X: All versions
RUGGEDCOM RSG2488F: All versions
RUGGEDCOM RSG2488NC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG2488NC V5.X: All versions
RUGGEDCOM RSG907R: All versions
RUGGEDCOM RSG908C: All versions
RUGGEDCOM RSG909R: All versions
RUGGEDCOM RSG910C: All versions
RUGGEDCOM RSG920P V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG920P V5.X: All versions
RUGGEDCOM RSG920PNC V4.X: All versions prior to V4.3.8
RUGGEDCOM RSG920PNC V5.X: All versions
RUGGEDCOM RSL910: All versions
RUGGEDCOM RSL910NC: All versions
RUGGEDCOM RST2228: All versions
RUGGEDCOM RST2228P: All versions
RUGGEDCOM RST916C: All versions
RUGGEDCOM RST916P: All versions

3.2 VULNERABILITY OVERVIEW

3.2.1 ALLOCATION OF RESOURCES WITHOUT LIMITS OR THROTTLING CWE-770

The affected devices’ web server contains a vulnerability that could lead to a denial-of-service condition. An attacker could cause total loss of web server availability, which could recover after the attack.

CVE-2023-39269 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

3.3 BACKGROUND

CRITICAL INFRASTRUCTURE SECTORS: Multiple
COUNTRIES/AREAS DEPLOYED: Worldwide
COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens released updates for several affected products and recommends updating to the latest versions. Siemens is preparing further updates and recommends countermeasures for products where updates are not or are not currently available:

Update to V4.3.8 or later versions.
RUGGEDCOM i800: Update to V4.3.8 or later versions.
RUGGEDCOM i800NC: Update to V4.3.8 or later versions.
RUGGEDCOM i801: Update to V4.3.8 or later versions.
RUGGEDCOM i801NC: Update to V4.3.8 or later versions.
RUGGEDCOM i802: Update to V4.3.8 or later versions.
RUGGEDCOM i802NC: Update to V4.3.8 or later versions.
RUGGEDCOM i803: Update to V4.3.8 or later versions.
RUGGEDCOM i803NC: Update to V4.3.8 or later versions.
RUGGEDCOM M2100: Update to V4.3.8 or later versions.
RUGGEDCOM M2100F: Currently no fix is planned.
RUGGEDCOM M2100NC: Update to V4.3.8 or later versions.
RUGGEDCOM M2200: Update to V4.3.8 or later versions.
RUGGEDCOM M2200F: Currently no fix is planned.
RUGGEDCOM M2200NC: Update to V4.3.8 or later versions.
RUGGEDCOM M969: Update to V4.3.8 or later versions.
RUGGEDCOM M969F: Currently no fix is planned.
RUGGEDCOM M969NC: Update to V4.3.8 or later versions.
RUGGEDCOM RMC30: Update to V4.3.8 or later versions.
RUGGEDCOM RMC30NC: Update to V4.3.8 or later versions.
RUGGEDCOM RMC8388 V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RMC8388 V5.X: Currently no fix is available.
RUGGEDCOM RMC8388NC V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RMC8388NC V5.X: Currently no fix is available.
RUGGEDCOM RP110: Update to V4.3.8 or later versions.
RUGGEDCOM RP110NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS1600: Update to V4.3.8 or later versions.
RUGGEDCOM RS1600F: Update to V4.3.8 or later versions.
RUGGEDCOM RS1600FNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS1600NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS1600T: Update to V4.3.8 or later versions.
RUGGEDCOM RS1600TNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS400: Update to V4.3.8 or later versions.
RUGGEDCOM RS400F: Currently no fix is planned.
RUGGEDCOM RS400NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS401: Update to V4.3.8 or later versions.
RUGGEDCOM RS401NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS416: Update to V4.3.8 or later versions.
RUGGEDCOM RS416F: Currently no fix is planned.
RUGGEDCOM RS416NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS416NC v2: Currently no fix is available.
RUGGEDCOM RS416P: Update to V4.3.8 or later versions.
RUGGEDCOM RS416PF: Currently no fix is planned.
RUGGEDCOM RS416PNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS416PNC v2: Currently no fix is available.
RUGGEDCOM RS416Pv2: Currently no fix is available.
RUGGEDCOM RS416v2: Currently no fix is available.
RUGGEDCOM RS8000: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000A: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000ANC: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000H: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000HNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000T: Update to V4.3.8 or later versions.
RUGGEDCOM RS8000TNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS900: Update to V4.3.8 or later versions.
RUGGEDCOM RS900 (32M) V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RS900 (32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900F: Currently no fix is planned.
RUGGEDCOM RS900G: Update to V4.3.8 or later versions.
RUGGEDCOM RS900G (32M) V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RS900G (32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900GF: Currently no fix is planned.
RUGGEDCOM RS900GNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS900GNC(32M) V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RS900GNC(32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900GP: Update to V4.3.8 or later versions.
RUGGEDCOM RS900GPF: Currently no fix is planned.
RUGGEDCOM RS900GPNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS900L: Update to V4.3.8 or later versions.
RUGGEDCOM RS900LNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS900M-GETS-C01: Update to V4.3.8 or later versions.
RUGGEDCOM RS900M-GETS-XX: Update to V4.3.8 or later versions.
RUGGEDCOM RS900M-STND-C01: Update to V4.3.8 or later versions.
RUGGEDCOM RS900M-STND-XX: Update to V4.3.8 or later versions.
RUGGEDCOM RS900MNC-GETS-C01: Update to V4.3.8 or later versions.
RUGGEDCOM RS900MNC-GETS-XX: Update to V4.3.8 or later versions.
RUGGEDCOM RS900MNC-STND-XX: Update to V4.3.8 or later versions.
RUGGEDCOM RS900MNC-STND-XX-C01: Update to V4.3.8 or later versions.
RUGGEDCOM RS900NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS900NC(32M) V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RS900NC(32M) V5.X: Currently no fix is available.
RUGGEDCOM RS900W: Update to V4.3.8 or later versions.
RUGGEDCOM RS910: Update to V4.3.8 or later versions.
RUGGEDCOM RS910L: Update to V4.3.8 or later versions.
RUGGEDCOM RS910LNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS910NC: Update to V4.3.8 or later versions.
RUGGEDCOM RS910W: Update to V4.3.8 or later versions.
RUGGEDCOM RS920L: Update to V4.3.8 or later versions.
RUGGEDCOM RS920LNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS920W: Update to V4.3.8 or later versions.
RUGGEDCOM RS930L: Update to V4.3.8 or later versions.
RUGGEDCOM RS930LNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS930W: Update to V4.3.8 or later versions.
RUGGEDCOM RS940G: Update to V4.3.8 or later versions.
RUGGEDCOM RS940GF: Currently no fix is planned.
RUGGEDCOM RS940GNC: Update to V4.3.8 or later versions.
RUGGEDCOM RS969: Update to V4.3.8 or later versions.
RUGGEDCOM RS969NC: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2100: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2100 (32M) V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2100 (32M) V5.X: Currently no fix is available.
RUGGEDCOM RSG2100F: Currently no fix is planned.
RUGGEDCOM RSG2100NC: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2100NC(32M) V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2100NC(32M) V5.X: Currently no fix is available.
RUGGEDCOM RSG2100P: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2100PF: Currently no fix is planned.
RUGGEDCOM RSG2100PNC: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2200: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2200F: Currently no fix is planned.
RUGGEDCOM RSG2200NC: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2288 V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2288 V5.X: Currently no fix is available.
RUGGEDCOM RSG2288NC V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2288NC V5.X: Currently no fix is available.
RUGGEDCOM RSG2300 V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2300 V5.X: Currently no fix is available.
RUGGEDCOM RSG2300F: Currently no fix is planned.
RUGGEDCOM RSG2300NC V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2300NC V5.X: Currently no fix is available.
RUGGEDCOM RSG2300P V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2300P V5.X: Currently no fix is available.
RUGGEDCOM RSG2300PF: Currently no fix is planned.
RUGGEDCOM RSG2300PNC V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2300PNC V5.X: Currently no fix is available.
RUGGEDCOM RSG2488 V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2488 V5.X: Currently no fix is available.
RUGGEDCOM RSG2488F: Currently no fix is planned.
RUGGEDCOM RSG2488NC V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG2488NC V5.X: Currently no fix is available.
RUGGEDCOM RSG907R: Currently no fix is available.
RUGGEDCOM RSG908C: Currently no fix is available.
RUGGEDCOM RSG909R: Currently no fix is available.
RUGGEDCOM RSG910C: Currently no fix is available.
RUGGEDCOM RSG920P V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG920P V5.X: Currently no fix is available.
RUGGEDCOM RSG920PNC V4.X: Update to V4.3.8 or later versions.
RUGGEDCOM RSG920PNC V5.X: Currently no fix is available.
RUGGEDCOM RSL910: Currently no fix is available.
RUGGEDCOM RSL910NC: Currently no fix is available.
RUGGEDCOM RST2228: Currently no fix is available.
RUGGEDCOM RST2228P: Currently no fix is available.
RUGGEDCOM RST916C: Currently no fix is available.
RUGGEDCOM RST916P: Currently no fix is available.
Restrict access to Port 80/tcp and 443/tcp to trusted IP addresses only.
Deactivate the webserver if not required and if the product supports deactivation.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the Siemens' operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage.

For more information see the associated Siemens security advisory SSA-770902 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
Locate control system networks and remote devices behind firewalls and isolate them from business networks.
When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage at cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

This product is provided subject to this Notification and this Privacy & Use policy.

Vendor

Siemens

​Resource Allocation in Siemens RUGGEDCOM