ICS Advisory

Siemens OpenSSL Vulnerabilities in Industrial Products (Update B)

Last Revised
Alert Code
ICSA-22-104-05

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

1. EXECUTIVE SUMMARY

  • CVSS v3 5.9
  • ATTENTION: Exploitable remotely/high attack complexity
  • Vendor: Siemens
  • Equipment: Siemens Industrial Products
  • Vulnerability: NULL Pointer Dereference

2. UPDATE INFORMATION

This updated advisory is a follow-up to the original advisory titled ICSA-22-104-05 Siemens OpenSSL Vulnerabilities in Industrial Products (Update A) that was published May 12, 2022, on the ICS webpage at cisa.gov/ics. 

3. RISK EVALUATION

Successful exploitation of this vulnerability may allow an unauthenticated attacker to cause a denial-of-service condition if a maliciously crafted renegotiation message is sent.

4. TECHNICAL DETAILS

4.1 AFFECTED PRODUCTS

Siemens reports this vulnerability affects the following products:

  • RUGGEDCOM CROSSBOW Station Access Controller: All versions since and including v5.2.0 only when running on ROX v2.14.0
  • RUGGEDCOM RCM1224: Versions 6.2 through 7.1
  • SCALANCE LPE9403 (6GK5998-3GS00-2AC2): All versions prior to v1.1
  • SCALANCE M804PB (6GK5804-0AP00-2AA2): Versions 6.2 through 7.1
  • SCALANCE M812-1 ADSL-Router (Annex A) (6GK5812-1AA00-2AA2): Versions 6.2 through 7.1
  • SCALANCE M812-1 ADSL-Router (Annex B) (6GK5812-1BA00-2AA2): Versions 6.2 through 7.1
  • SCALANCE M816-1 ADSL-Router (Annex A) (6GK5816-1AA00-2AA2): Versions 6.2 through 7.1
  • SCALANCE M816-1 ADSL-Router (Annex B) (6GK5816-1BA00-2AA2): Versions 6.2 through 7.11
  • SCALANCE M826-2 SHDSL-Router (6GK5826-2AB00-2AB2): Versions 6.2 through 7.1
  • SCALANCE M874-2 (6GK5874-2AA00-2AA2): Versions 6.2 through 7.1
  • SCALANCE M874-3 (6GK5874-3AA00-2AA2): Versions 6.2 through 7.1SCALANCE M876-3 (6GK5876-3AA02-2BA2): Versions 6.2 through 7.1SCALANCE M876-3 (ROK) (6GK5876-3AA02-2EA2): Versions 6.2 through 7.1SCALANCE M876-4 (EU) (6GK5876-4AA00-2BA2): Versions 6.2 through 7.1SCALANCE M876-4 (NAM) (6GK5876-4AA00-2DA2): Versions 6.2 through 7.1
  • SCALANCE S602: All versions since and including v4.1
  • SCALANCE S612: All versions since and including v4.1
  • SCALANCE S615 (6GK5615-0AA00-2AA2): Versions 6.2 through 7.1
  • SCALANCE S623: All versions since and including v4.1
  • SCALANCE S627-2M: All versions since and including v4.1
  • SCALANCE SC622-2C (6GK5622-2GS00-2AC2): Versions 2.0 through 2.1.4
  • SCALANCE SC632-2C (6GK5632-2GS00-2AC2): Versions 2.0 through 2.1.4
  • SCALANCE SC636-2C (6GK5636-2GS00-2AC2): Versions 2.0 through 2.1.4
  • SCALANCE SC642-2C (6GK5642-2GS00-2AC2): Versions 2.0 through 2.1.4
  • SCALANCE SC646-2C (6GK5646-2GS00-2AC2): Versions 2.0 through 2.1.4SCALANCE W1748-1 M12 (6GK5748-1GY01-0AA0): Versions 2.0 through 3.0
  • SCALANCE W1748-1 M12 (6GK5748-1GY01-0TA0): Versions 2.0 through 3.0
  • SCALANCE W1788-1 M12 (6GK5788-1GY01-0AA0): Versions 2.0 through 3.0
  • SCALANCE W1788-2 EEC M12 (6GK5788-2GY01-0TA0): Versions 2.0 through 3.0
  • SCALANCE W1788-2 M12 (6GK5788-2GY01-0AA0): Versions 2.0 through 3.0
  • SCALANCE W1788-2IA M12 (6GK5788-2HY01-0AA0): Versions 2.0 through 3.0
  • SCALANCE W-700 IEEE 802.11n family: All versions since and including v6.5
  • SCALANCE XB-200: All versions prior to v4.3
  • SCALANCE XC-200: All versions prior to v4.3
  • SCALANCE XF-200BA: All versions prior to v4.3
  • SCALANCE XM-400: All versions prior to v6.4
  • SCALANCE XP-200: All versions prior to v4.3
  • SCALANCE XR-300WG: All versions prior to v4.3
  • SCALANCE XR-500 Family: All versions prior to v6.4
  • SIMATIC Cloud Connect 7 CC712 (6GK1411-1AC00): Versions 1.1 through 1.6
  • SIMATIC Cloud Connect 7 CC716 (6GK1411-5AC00): Versions 1.1 through 1.6

--------- Begin Update B Part 1 of 1 --------- 

  • SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0): Versions since v3.1 and prior to v3.3.46 
  • SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0): Versions since v3.1 and prior to v3.3.46 
  • SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0): Versions since v3.1 and prior to v3.3.46 
  • SIMATIC CP 1243-7 LTE US (6GK7243-7SX30-0XE0): Versions since v3.1 and prior to v3.3.46 
  • SIMATIC CP 1243-8 IRC (6GK7243-8RX30-0XE0): Versions since v3.1 and prior to v3.3.46 

--------- End Update B Part 1 of 1 --------- 

  • SIMATIC CP 1542SP-1 IRC (incl. SIPLUS variants): All versions since and including v2.1
  • SIMATIC CP 1543-1 (6GK7543-1AX00-0XE0): Versions 2.2 through 3.0
  • SIMATIC CP 1543SP-1 (incl. SIPLUS variants): All versions since and including v2.1
  • SIMATIC CP 1545-1 (6GK7545-1GX00-0XE0): All versions since and including v1.0
  • SIMATIC HMI Comfort Outdoor Panels 7" & 15" (incl. SIPLUS variants): All versions prior to V17.0 Upd 2
  • SIMATIC HMI Comfort Panels 4" - 22" (incl. SIPLUS variants): All versions prior to V17.0 Upd 2
  • SIMATIC HMI KTP Mobile Panels: All versions prior to v17.0 Upd 2
  • SIMATIC Logon: Versions 1.6 Upd 2 through 1.6 Upd 5
  • SIMATIC MV540 H (6GF3540-0GE10): All versions prior to v3.1
  • SIMATIC MV540 S (6GF3540-0CD10): All versions prior to v3.1
  • SIMATIC MV550 H (6GF3550-0GE10): All versions prior to v3.1
  • SIMATIC MV550 S (6GF3550-0CD10): All versions prior to v3.1
  • SIMATIC MV560 U (6GF3560-0LE10): All versions prior to v3.1
  • SIMATIC MV560 X (6GF3560-0HE10): All versions prior to v3.1
  • SIMATIC PCS 7 TeleControl: All versions prior to v9.1
  • SIMATIC PCS neo: All versions prior to v3.1
  • SIMATIC PDM: Versions 9.1 Upd 7 through 9.2 SP 1
  • SIMATIC Process Historian OPC UA Server: All versions 2019 through 2020 Upd1
  • SIMATIC RF166C (6GT2002-0EE20): All versions prior to v2.0
  • SIMATIC RF185C (6GT2002-0JE10): All versions prior to v2.0
  • SIMATIC RF186C (6GT2002-0JE20): All versions prior to v2.0
  • SIMATIC RF186CI (6GT2002-0JE50): All versions prior to v2.0
  • SIMATIC RF188C (6GT2002-0JE40): All versions prior to v2.0
  • SIMATIC RF188CI (6GT2002-0JE60): All versions prior to v2.0
  • SIMATIC RF360R (6GT2801-5BA30): All versions prior to v2.0
  • SIMATIC RF610R (6GT2811-6BC10): All versions prior to v4.0
  • SIMATIC RF615R (6GT2811-6CC10): All versions prior to v4.0
  • SIMATIC RF650R (6GT2811-6AB20): All versions prior to v4.0
  • SIMATIC RF680R (6GT2811-6AA10): All versions prior to v4.0
  • SIMATIC RF685R (6GT2811-6CA10): All versions prior to v4.0
  • SIMATIC S7-1200 CPU family (incl. SIPLUS variants): All versions prior to v4.5.2
  • SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (MLFB: 6ES7518-4AX00-1AC0, 6AG1518-4AX00-4AC0, incl. SIPLUS variant): All versions prior to v2.9.3
  • SIMATIC WinCC Runtime Advanced: All versions prior to v17 Update 1
  • SIMATIC WinCC TeleControl: All versions
  • SINAMICS Connect 300: All versions
  • SINEC NMS: Versions 1.0 SP1 through 1.0 SP2
  • SINEMA Server: Versions 14 through 14 SP3
  • SINUMERIK OPC UA Server: All versions prior to v3.1 SP1
  • SIPLUS NET CP 1543-1 (6AG1543-1AX00-2XE0): Versions 2.2 through 3.0
  • SIPLUS TIM 1531 IRC (6AG1543-1MX00-7XE0): Versions 2.0 through 2.2
  • TIA Administrator: All versions prior to v1.0 SP4
  • TIM 1531 IRC (6GK7543-1MX00-0XE0): Versions 2.0 through 2.2

4.2 VULNERABILITY OVERVIEW

4.2.1    NULL POINTER DEREFERENCE CWE-476

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signature_algorithms extension, where it was present in the initial ClientHello, but includes a signature_algorithms_cert extension, then a NULL pointer dereference will occur, leading to a crash and a denial-of-service condition.

A server is only vulnerable if it has TLSv1.2 and renegotiation enabled, which is the default configuration. OpenSSL TLS clients are not impacted by this issue. All OpenSSL 1.1.1 versions are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1k. OpenSSL 1.0.2 is not impacted by this issue. This vulnerability is fixed in OpenSSL 1.1.1k.

CVE-2021-3449 has been assigned to this vulnerability. A CVSS v3 base score of 5.9 has been calculated. the CVSS vector string is (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

4.3 BACKGROUND

  • CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
  • COUNTRIES/AREAS DEPLOYED: Worldwide
  • COMPANY HEADQUARTERS LOCATION: Germany

4.4 RESEARCHER

Siemens reported this vulnerability to CISA.

5. MITIGATIONS

Siemens has released updates for several affected products and recommends updating to the latest versions available. Siemens is preparing further updates and recommends countermeasures for products where updates are not, or not yet available. Please see Siemens SSA-772220 to determine if there is an update available.

As a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens' operational guidelines for industrial security, and to follow the recommendations in the product manuals. Additional information on Industrial Security by Siemens can be found at: https://www.siemens.com/industrialsecurity

For further inquiries on security vulnerabilities in Siemens products and solutions, please contact Siemens.

Additional Reference: SSA-772220 (PDF)

Additional Reference: SSA-772220 (TXT)

Additional Reference: SSA-772220 (CSAF)

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:

  • Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the Internet.
  • Locate control system networks and remote devices behind firewalls and isolate them from the business network.
  • When remote access is required, use secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.



CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov/ics in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.



Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

No known public exploits specifically target this vulnerability.

This product is provided subject to this Notification and this Privacy & Use policy.

Vendor

  • Siemens

Please share your thoughts

We recently updated our anonymous product survey; we’d welcome your feedback.