ICS Advisory

Siemens PROFINET DCP (Update V)

Last Revised
Alert Code
ICSA-17-129-02

1. EXECUTIVE SUMMARY

  • CVSS v3 6.5
  • ATTENTION: Exploitable from an adjacent network/low attack complexity
  • Vendor: Siemens
  • Equipment: Devices using the PROFINET Discovery and Configuration Protocol (DCP)
  • Vulnerabilities: Uncontrolled Resource Consumption

2. UPDATE INFORMATION

This updated advisory is a follow-up to the advisory update titled ICSA-17-129-02 Siemens PROFINET DCP (Update U) that was published October 14, 2021, to the ICS webpage on us-cert.cisa.gov.

3. RISK EVALUATION

Successful exploitation of these vulnerabilities could cause the targeted device to enter a denial-of-service condition, which may require human interaction to recover the system.

4. TECHNICAL DETAILS

4.1 AFFECTED PRODUCTS

Siemens reports these vulnerabilities affect the following products using PROFINET DCP:

  • Development/Evaluation Kits DK Standard Ethernet Controller: All versions prior to v4.1.1 Patch04
  • Development/Evaluation Kits for PROFINET IO EK-ERTEC 200: All versions prior to v4.2.1 Patch03
  • Development/Evaluation Kits for PROFINET IO EK-ERTEC 200P: All versions prior to v4.4.0 Patch01
  •  IE/AS-i Link PN IO: All versions
  • IE/PB-Link: All versions prior to v3.0
  • SCALANCE M-800 / S615: All versions prior to v04.03
  • SCALANCE W700: All versions prior to v6.1
  • SCALANCE X408: All versions prior to v4.1.0
  • SCALANCE X414: All versions prior to v3.10.2
  • SCALANCE X-200 switch family (incl. SIPLUS NET variants): All versions prior to v5.2.2
  • SCALANCE X-200IRT switch family (incl. SIPLUS NET variants): All versions prior to v5.4.0
  • SCALANCE X-300 switch family (incl. SIPLUS NET variants): All versions prior to v4.1.0
  • SCALANCE XM-400, XR-500 families: All versions prior to v6.1
  • SIMATIC CM 1542-1: All versions prior to v2.0
  • SIMATIC CM 1542SP-1: All versions prior to v1.0.15
  • SIMATIC CP 343-1 (incl. SIPLUS variants): All versions prior to v3.1.3
  • SIMATIC CP 343-1 Advanced (incl. SIPLUS variants): All versions
  • SIMATIC CP 343-1 Lean (incl. SIPLUS variants): All versions prior to v3.1.3
  • SIMATIC CP 443-1 (incl. SIPLUS variants): All versions prior to v3.2.17
  • SIMATIC CP 443-1 Advanced (incl. SIPLUS variants): All versions prior to v3.2.17
  • SIMATIC CP 443-1 OPC-UA: All versions
  • SIMATIC CP 1243-1 (incl. SIPLUS variants): All versions prior to v2.1.82
  • SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants): All versions
  • SIMATIC CP 1243-1 IEC (incl. SIPLUS variants): All versions
  • SIMATIC CP 1243-1 IRC (incl. SIPLUS variants): All versions prior to v2.1.82
  • SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants): All versions prior to v1.0.15
  • SIMATIC CP 1543-1 (incl. SIPLUS variants): All versions prior to v2.1
  • SIMATIC CP 1543SP-1 (incl. SIPLUS variants): All versions prior to v1.0.15
  • SIMATIC CP 1604: All versions prior to v2.7
  • SIMATIC CP 1616: All versions prior to v2.7
  • SIMATIC DK-16xx PN IO: All versions prior to v2.7
  • SIMATIC ET 200AL: All versions prior to v1.0.2
  • SIMATIC ET200ecoPN, 4AO U/I 4xM12 (6ES7145-6HD00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8 DIO, DC24V/1,3A, 8xM12 (6ES7147-6BG00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8 DO, DC24V/2A, 8xM12 (6ES7142-6BR00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8AI RTD/TC 8xM12 (6ES7144-6KD50-0AB0): All versions
  • SIMATIC ET200ecoPN, 8AI; 4 U/I; 4 RTD/TC 8xM12 (6ES7144-6KD00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8DI, DC24V, 4xM12 (6ES7141-6BF00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8DI, DC24V, 8xM12 (6ES7141-6BG00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8DO, DC24V/0,5A, 4xM12 (6ES7142-6BF50-0AB0): All versions
  • SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 4xM12 (6ES7142-6BF00-0AB0): All versions
  • SIMATIC ET200ecoPN, 8DO, DC24V/1,3A, 8xM12 (6ES7142-6BG00-0AB0): All versions
  • SIMATIC ET200ecoPN, 16DI, DC24V, 8xM12 (6ES7141-6BH00-0AB0): All versions
  • SIMATIC ET200ecoPN, 16DO DC24V/1,3A, 8xM12 (6ES7142-6BH00-0AB0): All versions
  • SIMATIC ET200ecoPN: IO-Link Master (6ES7148-6JA00-0AB0): All versions
  • SIMATIC ET200M (incl. SIPLUS variants): All versions
  • SIMATIC ET200MP IM155-5 PN BA (incl. SIPLUS variants): All versions prior to v4.0.1
  • SIMATIC ET200MP IM155-5 PN HF (incl. SIPLUS variants): All versions prior to v4.2
  • SIMATIC ET200MP IM155-5 PN ST (incl. SIPLUS variants): All versions prior to v4.1
  • SIMATIC ET200pro: All versions
  • SIMATIC ET200S (incl. SIPLUS variants): All versions
  • SIMATIC ET200SP (incl. SIPLUS variants, except IM155-6 PN ST and IM155-6 PN HF): All versions
  • SIMATIC ET200SP IM155-6 PN HF (incl. SIPLUS variants): All versions prior to v4.2.0
  • SIMATIC ET200SP IM155-6 PN HS (incl. SIPLUS variants): All versions prior to v4.0.1
  • SIMATIC ET200SP IM155-6 PN ST (incl. SIPLUS variants): All versions prior to v4.1.0
  • SIMATIC HMI Comfort Panels, HMI Multi Panels, HMI Mobile Panels (incl. SIPLUS variants): All versions prior to v15.1
  • SIMATIC MV400 family: All versions prior to v7.0.6
  • SIMATIC PN/PN Coupler (incl. SIPLUS NET variants): All versions prior to v4.0
  • SIMATIC RF650R: All versions prior to v3.0
  • SIMATIC RF680R: All versions prior to v3.0
  • SIMATIC RF685R: All versions prior to v3.0
  • SIMATIC S7-200 SMART: All versions prior to v2.3
  • SIMATIC S7-300 CPU family (incl. related ET200 CPUs and SIPLUS variants): All versions prior to v3.X.14
  • SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants): All versions prior to v6.0.7
  • SIMATIC S7-400 PN/DP V6 CPU family (incl. SIPLUS variants): All versions prior to v6.0.6
  • SIMATIC S7-400 PN/DP V7 CPU family (incl. SIPLUS variants): All versions prior to v7.0.2
  • SIMATIC S7-410 CPU family (incl. SIPLUS variants): All versions prior to v8.2
  • SIMATIC S7-1200 CPU family (incl. SIPLUS variants): All versions prior to v4.2.1
  • SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants): All versions prior to v2.1
  • SIMATIC S7-1500 Software Controller (incl. F): All versions prior to v2.1
  • SIMATIC TDC CP51M1: All versions prior to v1.1.8
  • SIMATIC TDC CPU555: All versions prior to v1.1.1
  • SIMATIC Teleservice Adapter IE Advanced: All versions
  • SIMATIC Teleservice Adapter IE Basic: All versions
  • SIMATIC Teleservice Adapter IE Standard: All versions
  • SIMATIC WinAC RTX (F) 2010: All versions prior to SIMATIC WinAC RTX 2010 SP3
  • SIMOCODE pro V PN (incl. SIPLUS variants): All versions prior to v2.0.0
  • SIMOTION (incl. SIPLUS variants): All versions prior to v4.5 HF1
  • SINAMICS DCM w. PN: All versions prior to v1.4 SP1 HF5
  • SINAMICS DCP w. PN: All versions prior to v1.2 HF1
  • SINAMICS G110M w. PN: All versions prior to v4.7 SP6 HF3
  • SINAMICS G120(C/P/D) w. PN (incl. SIPLUS variants): All versions prior to v4.7 SP6 HF3
  • SINAMICS G130 v4.7 w. PN: All versions prior to v4.7 HF27
  • SINAMICS G130 v4.8 w. PN: All versions prior to v4.8 HF4
  • SINAMICS G150 v4.7 w. PN: v4.7: All versions prior to v4.7 HF27
  • SINAMICS G150 v4.8 w. PN: All versions prior to v4.8 HF4
  • SINAMICS S110 w. PN: All versions prior to V4.4 SP3 HF5
  • SINAMICS S120 prior to v4.7 w. PN (incl. SIPLUS variants): All versions prior to v4.7
  • SINAMICS S120 v4.7 SP1 w. PN (incl. SIPLUS variants): All versions
  • SINAMICS S120 v4.7 w. PN (incl. SIPLUS variants): All versions prior to v4.7 HF27
  • SINAMICS S120 v4.8 w. PN (incl. SIPLUS variants): All versions prior to v4.8 HF4
  • SINAMICS S150 v4.7 w. PN: All versions prior to v4.7 HF27
  • SINAMICS S150 v4.8 w. PN: All versions prior to v4.8 HF4
  • SINAMICS V90 w. PN: All versions prior to v1.01
  • SINUMERIK 828D v4.5 and prior: All versions prior to v4.5 SP6 HF2
  • SINUMERIK 828D v4.7: All versions prior to v4.7 SP4 HF1
  • SINUMERIK 840D sl v4.5 and prior: All versions prior to v4.5 SP6 HF2
  • SINUMERIK 840D sl v4.7: All versions prior to v4.7 SP4 HF1
  • SIRIUS ACT 3SU1 interface module PROFINET: All versions prior to v1.1.0
  • SIRIUS Motor Starter M200D PROFINET: All versions
  • SIRIUS Soft Starter 3RW44 PN: All versions
  • SITOP PSU8600 PROFINET: All versions prior to v1.2.0
  • SITOP UPS1600 PROFINET (incl. SIPLUS variants): All versions prior to v2.2.0
  • Softnet PROFINET IO for PC-based Windows systems: All versions prior to v14 SP1

4.2 VULNERABILITY OVERVIEW

4.2.1 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

Specially crafted PROFINET DCP broadcast packets could cause a denial-of-service condition of affected products on a local Ethernet segment (Layer 2). Human interaction is required to recover the systems. PROFIBUS interfaces are not affected..

CVE-2017-2680 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

4.2.2 UNCONTROLLED RESOURCE CONSUMPTION CWE-400

Specially crafted PROFINET DCP packets sent on a local Ethernet segment (Layer 2) to an affected product could cause a denial-of-service condition in that product. Human interaction is required to recover the system. PROFIBUS interfaces are not affected.



This vulnerability affects only SIMATIC HMI Multi Panels and HMI Mobile Panels, and S7-300/S7-400 devices.



CVE-2017-2681 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

4.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Chemical, Critical Manufacturing, Energy, Food and Agriculture, Water and Wastewater Systems
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

4.4 RESEARCHER

Duan JinTong, Ma ShaoShuai, and Cheng Lei from the NSFOCUS Security Team reported these vulnerabilities to Siemens.

5. MITIGATIONS

The attacker must have network access to the local Ethernet segment (Layer 2).

Siemens provides firmware updates fixing these vulnerabilities for the following affected products and recommends users update to the new fixed version:

--------- Begin Update V Part 1 of 1 ---------

  • SIMATIC ET 200SP: No remediation is currently planned

--------- End Update V Part 1 of 1 ---------

SINUMERIK software updates listed above can be obtained from a Siemens account manager.

Siemens is preparing updates for the remaining affected products and recommends the following mitigations in the meantime:

  • Apply cell protection concept.
  • Use VPN for protecting network communication between cells.
  • Apply defense-in-depth.

As a general security measure Siemens strongly recommends protecting industrial control systems networks with appropriate mechanisms. Siemens strongly recommends verifying the affected products are protected as described in PROFINET Security Guidelines and Siemens Operational Guidelines in order to run the devices in a protected IT environment.

For more information on these vulnerabilities and more detailed mitigation instructions, please see Siemens Security Advisory SSA-293562

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.



CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.



Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target these vulnerabilities.

This product is provided subject to this Notification and this Privacy & Use policy.

Vendor

  • Siemens

Please share your thoughts

We recently updated our anonymous product survey; we’d welcome your feedback.